← Commit list

5d044ad948

Stefan Eissing

2024-01-11

SUCCESS Duration: 97s

Subject

vquic: extract TLS setup into own source

Binary

Download Binary (846 KB)

Architecture & Compiler Flags

Architecture: x86_64-linux-gnu Compiler: gcc (Ubuntu 11.4.0-1ubuntu1~22.04.3) 11.4.0

—

Build Log

$ git checkout -f 5d044ad9480a9f556f4b6a252d7533b1ba7fe57e
Previous HEAD position was b3f02e1d92 configure: when enabling QUIC, check that TLS supports QUIC
HEAD is now at 5d044ad948 vquic: extract TLS setup into own source

$ git clean -fdx
Removing Makefile
Removing Makefile.in
Removing aclocal.m4
Removing autom4te.cache/
Removing compile
Removing config.guess
Removing config.log
Removing config.status
Removing config.sub
Removing configure
Removing curl-config
Removing depcomp
Removing docs/Makefile
Removing docs/Makefile.in
Removing docs/cmdline-opts/Makefile
Removing docs/cmdline-opts/Makefile.in
Removing docs/curl.1
Removing docs/examples/.deps/
Removing docs/examples/Makefile
Removing docs/examples/Makefile.in
Removing docs/libcurl/Makefile
Removing docs/libcurl/Makefile.in
Removing docs/libcurl/opts/Makefile
Removing docs/libcurl/opts/Makefile.in
Removing include/Makefile
Removing include/Makefile.in
Removing include/curl/Makefile
Removing include/curl/Makefile.in
Removing install-sh
Removing lib/.deps/
Removing lib/.dirstamp
Removing lib/.libs/
Removing lib/Makefile
Removing lib/Makefile.in
Removing lib/base64.o
Removing lib/curl_config.h
Removing lib/curl_config.h.in
Removing lib/curl_multibyte.o
Removing lib/dynbuf.o
Removing lib/libcurl.la
Removing lib/libcurl.plist
Removing lib/libcurl.vers
Removing lib/libcurl_la-altsvc.lo
Removing lib/libcurl_la-altsvc.o
Removing lib/libcurl_la-amigaos.lo
Removing lib/libcurl_la-amigaos.o
Removing lib/libcurl_la-asyn-ares.lo
Removing lib/libcurl_la-asyn-ares.o
Removing lib/libcurl_la-asyn-thread.lo
Removing lib/libcurl_la-asyn-thread.o
Removing lib/libcurl_la-base64.lo
Removing lib/libcurl_la-base64.o
Removing lib/libcurl_la-bufq.lo
Removing lib/libcurl_la-bufq.o
Removing lib/libcurl_la-bufref.lo
Removing lib/libcurl_la-bufref.o
Removing lib/libcurl_la-c-hyper.lo
Removing lib/libcurl_la-c-hyper.o
Removing lib/libcurl_la-cf-h1-proxy.lo
Removing lib/libcurl_la-cf-h1-proxy.o
Removing lib/libcurl_la-cf-h2-proxy.lo
Removing lib/libcurl_la-cf-h2-proxy.o
Removing lib/libcurl_la-cf-haproxy.lo
Removing lib/libcurl_la-cf-haproxy.o
Removing lib/libcurl_la-cf-https-connect.lo
Removing lib/libcurl_la-cf-https-connect.o
Removing lib/libcurl_la-cf-socket.lo
Removing lib/libcurl_la-cf-socket.o
Removing lib/libcurl_la-cfilters.lo
Removing lib/libcurl_la-cfilters.o
Removing lib/libcurl_la-conncache.lo
Removing lib/libcurl_la-conncache.o
Removing lib/libcurl_la-connect.lo
Removing lib/libcurl_la-connect.o
Removing lib/libcurl_la-content_encoding.lo
Removing lib/libcurl_la-content_encoding.o
Removing lib/libcurl_la-cookie.lo
Removing lib/libcurl_la-cookie.o
Removing lib/libcurl_la-curl_addrinfo.lo
Removing lib/libcurl_la-curl_addrinfo.o
Removing lib/libcurl_la-curl_des.lo
Removing lib/libcurl_la-curl_des.o
Removing lib/libcurl_la-curl_endian.lo
Removing lib/libcurl_la-curl_endian.o
Removing lib/libcurl_la-curl_fnmatch.lo
Removing lib/libcurl_la-curl_fnmatch.o
Removing lib/libcurl_la-curl_get_line.lo
Removing lib/libcurl_la-curl_get_line.o
Removing lib/libcurl_la-curl_gethostname.lo
Removing lib/libcurl_la-curl_gethostname.o
Removing lib/libcurl_la-curl_gssapi.lo
Removing lib/libcurl_la-curl_gssapi.o
Removing lib/libcurl_la-curl_memrchr.lo
Removing lib/libcurl_la-curl_memrchr.o
Removing lib/libcurl_la-curl_multibyte.lo
Removing lib/libcurl_la-curl_multibyte.o
Removing lib/libcurl_la-curl_ntlm_core.lo
Removing lib/libcurl_la-curl_ntlm_core.o
Removing lib/libcurl_la-curl_ntlm_wb.lo
Removing lib/libcurl_la-curl_ntlm_wb.o
Removing lib/libcurl_la-curl_path.lo
Removing lib/libcurl_la-curl_path.o
Removing lib/libcurl_la-curl_range.lo
Removing lib/libcurl_la-curl_range.o
Removing lib/libcurl_la-curl_rtmp.lo
Removing lib/libcurl_la-curl_rtmp.o
Removing lib/libcurl_la-curl_sasl.lo
Removing lib/libcurl_la-curl_sasl.o
Removing lib/libcurl_la-curl_sspi.lo
Removing lib/libcurl_la-curl_sspi.o
Removing lib/libcurl_la-curl_threads.lo
Removing lib/libcurl_la-curl_threads.o
Removing lib/libcurl_la-curl_trc.lo
Removing lib/libcurl_la-curl_trc.o
Removing lib/libcurl_la-dict.lo
Removing lib/libcurl_la-dict.o
Removing lib/libcurl_la-doh.lo
Removing lib/libcurl_la-doh.o
Removing lib/libcurl_la-dynbuf.lo
Removing lib/libcurl_la-dynbuf.o
Removing lib/libcurl_la-dynhds.lo
Removing lib/libcurl_la-dynhds.o
Removing lib/libcurl_la-easy.lo
Removing lib/libcurl_la-easy.o
Removing lib/libcurl_la-easygetopt.lo
Removing lib/libcurl_la-easygetopt.o
Removing lib/libcurl_la-easyoptions.lo
Removing lib/libcurl_la-easyoptions.o
Removing lib/libcurl_la-escape.lo
Removing lib/libcurl_la-escape.o
Removing lib/libcurl_la-file.lo
Removing lib/libcurl_la-file.o
Removing lib/libcurl_la-fileinfo.lo
Removing lib/libcurl_la-fileinfo.o
Removing lib/libcurl_la-fopen.lo
Removing lib/libcurl_la-fopen.o
Removing lib/libcurl_la-formdata.lo
Removing lib/libcurl_la-formdata.o
Removing lib/libcurl_la-ftp.lo
Removing lib/libcurl_la-ftp.o
Removing lib/libcurl_la-ftplistparser.lo
Removing lib/libcurl_la-ftplistparser.o
Removing lib/libcurl_la-getenv.lo
Removing lib/libcurl_la-getenv.o
Removing lib/libcurl_la-getinfo.lo
Removing lib/libcurl_la-getinfo.o
Removing lib/libcurl_la-gopher.lo
Removing lib/libcurl_la-gopher.o
Removing lib/libcurl_la-hash.lo
Removing lib/libcurl_la-hash.o
Removing lib/libcurl_la-headers.lo
Removing lib/libcurl_la-headers.o
Removing lib/libcurl_la-hmac.lo
Removing lib/libcurl_la-hmac.o
Removing lib/libcurl_la-hostasyn.lo
Removing lib/libcurl_la-hostasyn.o
Removing lib/libcurl_la-hostip.lo
Removing lib/libcurl_la-hostip.o
Removing lib/libcurl_la-hostip4.lo
Removing lib/libcurl_la-hostip4.o
Removing lib/libcurl_la-hostip6.lo
Removing lib/libcurl_la-hostip6.o
Removing lib/libcurl_la-hostsyn.lo
Removing lib/libcurl_la-hostsyn.o
Removing lib/libcurl_la-hsts.lo
Removing lib/libcurl_la-hsts.o
Removing lib/libcurl_la-http.lo
Removing lib/libcurl_la-http.o
Removing lib/libcurl_la-http1.lo
Removing lib/libcurl_la-http1.o
Removing lib/libcurl_la-http2.lo
Removing lib/libcurl_la-http2.o
Removing lib/libcurl_la-http_aws_sigv4.lo
Removing lib/libcurl_la-http_aws_sigv4.o
Removing lib/libcurl_la-http_chunks.lo
Removing lib/libcurl_la-http_chunks.o
Removing lib/libcurl_la-http_digest.lo
Removing lib/libcurl_la-http_digest.o
Removing lib/libcurl_la-http_negotiate.lo
Removing lib/libcurl_la-http_negotiate.o
Removing lib/libcurl_la-http_ntlm.lo
Removing lib/libcurl_la-http_ntlm.o
Removing lib/libcurl_la-http_proxy.lo
Removing lib/libcurl_la-http_proxy.o
Removing lib/libcurl_la-idn.lo
Removing lib/libcurl_la-idn.o
Removing lib/libcurl_la-if2ip.lo
Removing lib/libcurl_la-if2ip.o
Removing lib/libcurl_la-imap.lo
Removing lib/libcurl_la-imap.o
Removing lib/libcurl_la-inet_ntop.lo
Removing lib/libcurl_la-inet_ntop.o
Removing lib/libcurl_la-inet_pton.lo
Removing lib/libcurl_la-inet_pton.o
Removing lib/libcurl_la-krb5.lo
Removing lib/libcurl_la-krb5.o
Removing lib/libcurl_la-ldap.lo
Removing lib/libcurl_la-ldap.o
Removing lib/libcurl_la-llist.lo
Removing lib/libcurl_la-llist.o
Removing lib/libcurl_la-macos.lo
Removing lib/libcurl_la-macos.o
Removing lib/libcurl_la-md4.lo
Removing lib/libcurl_la-md4.o
Removing lib/libcurl_la-md5.lo
Removing lib/libcurl_la-md5.o
Removing lib/libcurl_la-memdebug.lo
Removing lib/libcurl_la-memdebug.o
Removing lib/libcurl_la-mime.lo
Removing lib/libcurl_la-mime.o
Removing lib/libcurl_la-mprintf.lo
Removing lib/libcurl_la-mprintf.o
Removing lib/libcurl_la-mqtt.lo
Removing lib/libcurl_la-mqtt.o
Removing lib/libcurl_la-multi.lo
Removing lib/libcurl_la-multi.o
Removing lib/libcurl_la-netrc.lo
Removing lib/libcurl_la-netrc.o
Removing lib/libcurl_la-nonblock.lo
Removing lib/libcurl_la-nonblock.o
Removing lib/libcurl_la-noproxy.lo
Removing lib/libcurl_la-noproxy.o
Removing lib/libcurl_la-openldap.lo
Removing lib/libcurl_la-openldap.o
Removing lib/libcurl_la-parsedate.lo
Removing lib/libcurl_la-parsedate.o
Removing lib/libcurl_la-pingpong.lo
Removing lib/libcurl_la-pingpong.o
Removing lib/libcurl_la-pop3.lo
Removing lib/libcurl_la-pop3.o
Removing lib/libcurl_la-progress.lo
Removing lib/libcurl_la-progress.o
Removing lib/libcurl_la-psl.lo
Removing lib/libcurl_la-psl.o
Removing lib/libcurl_la-rand.lo
Removing lib/libcurl_la-rand.o
Removing lib/libcurl_la-rename.lo
Removing lib/libcurl_la-rename.o
Removing lib/libcurl_la-rtsp.lo
Removing lib/libcurl_la-rtsp.o
Removing lib/libcurl_la-select.lo
Removing lib/libcurl_la-select.o
Removing lib/libcurl_la-sendf.lo
Removing lib/libcurl_la-sendf.o
Removing lib/libcurl_la-setopt.lo
Removing lib/libcurl_la-setopt.o
Removing lib/libcurl_la-sha256.lo
Removing lib/libcurl_la-sha256.o
Removing lib/libcurl_la-share.lo
Removing lib/libcurl_la-share.o
Removing lib/libcurl_la-slist.lo
Removing lib/libcurl_la-slist.o
Removing lib/libcurl_la-smb.lo
Removing lib/libcurl_la-smb.o
Removing lib/libcurl_la-smtp.lo
Removing lib/libcurl_la-smtp.o
Removing lib/libcurl_la-socketpair.lo
Removing lib/libcurl_la-socketpair.o
Removing lib/libcurl_la-socks.lo
Removing lib/libcurl_la-socks.o
Removing lib/libcurl_la-socks_gssapi.lo
Removing lib/libcurl_la-socks_gssapi.o
Removing lib/libcurl_la-socks_sspi.lo
Removing lib/libcurl_la-socks_sspi.o
Removing lib/libcurl_la-speedcheck.lo
Removing lib/libcurl_la-speedcheck.o
Removing lib/libcurl_la-splay.lo
Removing lib/libcurl_la-splay.o
Removing lib/libcurl_la-strcase.lo
Removing lib/libcurl_la-strcase.o
Removing lib/libcurl_la-strdup.lo
Removing lib/libcurl_la-strdup.o
Removing lib/libcurl_la-strerror.lo
Removing lib/libcurl_la-strerror.o
Removing lib/libcurl_la-strtok.lo
Removing lib/libcurl_la-strtok.o
Removing lib/libcurl_la-strtoofft.lo
Removing lib/libcurl_la-strtoofft.o
Removing lib/libcurl_la-system_win32.lo
Removing lib/libcurl_la-system_win32.o
Removing lib/libcurl_la-telnet.lo
Removing lib/libcurl_la-telnet.o
Removing lib/libcurl_la-tftp.lo
Removing lib/libcurl_la-tftp.o
Removing lib/libcurl_la-timediff.lo
Removing lib/libcurl_la-timediff.o
Removing lib/libcurl_la-timeval.lo
Removing lib/libcurl_la-timeval.o
Removing lib/libcurl_la-transfer.lo
Removing lib/libcurl_la-transfer.o
Removing lib/libcurl_la-url.lo
Removing lib/libcurl_la-url.o
Removing lib/libcurl_la-urlapi.lo
Removing lib/libcurl_la-urlapi.o
Removing lib/libcurl_la-version.lo
Removing lib/libcurl_la-version.o
Removing lib/libcurl_la-version_win32.lo
Removing lib/libcurl_la-version_win32.o
Removing lib/libcurl_la-warnless.lo
Removing lib/libcurl_la-warnless.o
Removing lib/libcurl_la-ws.lo
Removing lib/libcurl_la-ws.o
Removing lib/nonblock.o
Removing lib/stamp-h1
Removing lib/strtoofft.o
Removing lib/timediff.o
Removing lib/vauth/.deps/
Removing lib/vauth/.dirstamp
Removing lib/vauth/libcurl_la-cleartext.lo
Removing lib/vauth/libcurl_la-cleartext.o
Removing lib/vauth/libcurl_la-cram.lo
Removing lib/vauth/libcurl_la-cram.o
Removing lib/vauth/libcurl_la-digest.lo
Removing lib/vauth/libcurl_la-digest.o
Removing lib/vauth/libcurl_la-digest_sspi.lo
Removing lib/vauth/libcurl_la-digest_sspi.o
Removing lib/vauth/libcurl_la-gsasl.lo
Removing lib/vauth/libcurl_la-gsasl.o
Removing lib/vauth/libcurl_la-krb5_gssapi.lo
Removing lib/vauth/libcurl_la-krb5_gssapi.o
Removing lib/vauth/libcurl_la-krb5_sspi.lo
Removing lib/vauth/libcurl_la-krb5_sspi.o
Removing lib/vauth/libcurl_la-ntlm.lo
Removing lib/vauth/libcurl_la-ntlm.o
Removing lib/vauth/libcurl_la-ntlm_sspi.lo
Removing lib/vauth/libcurl_la-ntlm_sspi.o
Removing lib/vauth/libcurl_la-oauth2.lo
Removing lib/vauth/libcurl_la-oauth2.o
Removing lib/vauth/libcurl_la-spnego_gssapi.lo
Removing lib/vauth/libcurl_la-spnego_gssapi.o
Removing lib/vauth/libcurl_la-spnego_sspi.lo
Removing lib/vauth/libcurl_la-spnego_sspi.o
Removing lib/vauth/libcurl_la-vauth.lo
Removing lib/vauth/libcurl_la-vauth.o
Removing lib/version_win32.o
Removing lib/vquic/.deps/
Removing lib/vquic/.dirstamp
Removing lib/vquic/libcurl_la-curl_msh3.lo
Removing lib/vquic/libcurl_la-curl_msh3.o
Removing lib/vquic/libcurl_la-curl_ngtcp2.lo
Removing lib/vquic/libcurl_la-curl_ngtcp2.o
Removing lib/vquic/libcurl_la-curl_quiche.lo
Removing lib/vquic/libcurl_la-curl_quiche.o
Removing lib/vquic/libcurl_la-vquic-tls.lo
Removing lib/vquic/libcurl_la-vquic-tls.o
Removing lib/vquic/libcurl_la-vquic.lo
Removing lib/vquic/libcurl_la-vquic.o
Removing lib/vssh/.deps/
Removing lib/vssh/.dirstamp
Removing lib/vssh/libcurl_la-libssh.lo
Removing lib/vssh/libcurl_la-libssh.o
Removing lib/vssh/libcurl_la-libssh2.lo
Removing lib/vssh/libcurl_la-libssh2.o
Removing lib/vssh/libcurl_la-wolfssh.lo
Removing lib/vssh/libcurl_la-wolfssh.o
Removing lib/vtls/.deps/
Removing lib/vtls/.dirstamp
Removing lib/vtls/libcurl_la-bearssl.lo
Removing lib/vtls/libcurl_la-bearssl.o
Removing lib/vtls/libcurl_la-gtls.lo
Removing lib/vtls/libcurl_la-gtls.o
Removing lib/vtls/libcurl_la-hostcheck.lo
Removing lib/vtls/libcurl_la-hostcheck.o
Removing lib/vtls/libcurl_la-keylog.lo
Removing lib/vtls/libcurl_la-keylog.o
Removing lib/vtls/libcurl_la-mbedtls.lo
Removing lib/vtls/libcurl_la-mbedtls.o
Removing lib/vtls/libcurl_la-mbedtls_threadlock.lo
Removing lib/vtls/libcurl_la-mbedtls_threadlock.o
Removing lib/vtls/libcurl_la-openssl.lo
Removing lib/vtls/libcurl_la-openssl.o
Removing lib/vtls/libcurl_la-rustls.lo
Removing lib/vtls/libcurl_la-rustls.o
Removing lib/vtls/libcurl_la-schannel.lo
Removing lib/vtls/libcurl_la-schannel.o
Removing lib/vtls/libcurl_la-schannel_verify.lo
Removing lib/vtls/libcurl_la-schannel_verify.o
Removing lib/vtls/libcurl_la-sectransp.lo
Removing lib/vtls/libcurl_la-sectransp.o
Removing lib/vtls/libcurl_la-vtls.lo
Removing lib/vtls/libcurl_la-vtls.o
Removing lib/vtls/libcurl_la-wolfssl.lo
Removing lib/vtls/libcurl_la-wolfssl.o
Removing lib/vtls/libcurl_la-x509asn1.lo
Removing lib/vtls/libcurl_la-x509asn1.o
Removing lib/warnless.o
Removing libcurl.pc
Removing libtool
Removing ltmain.sh
Removing m4/libtool.m4
Removing m4/ltoptions.m4
Removing m4/ltsugar.m4
Removing m4/ltversion.m4
Removing m4/lt~obsolete.m4
Removing missing
Removing packages/Makefile
Removing packages/Makefile.in
Removing packages/vms/Makefile
Removing packages/vms/Makefile.in
Removing scripts/Makefile
Removing scripts/Makefile.in
Removing src/.deps/
Removing src/.libs/
Removing src/Makefile
Removing src/Makefile.in
Removing src/curl
Removing src/slist_wc.o
Removing src/tool_binmode.o
Removing src/tool_bname.o
Removing src/tool_cb_dbg.o
Removing src/tool_cb_hdr.o
Removing src/tool_cb_prg.o
Removing src/tool_cb_rea.o
Removing src/tool_cb_see.o
Removing src/tool_cb_wrt.o
Removing src/tool_cfgable.o
Removing src/tool_dirhie.o
Removing src/tool_doswin.o
Removing src/tool_easysrc.o
Removing src/tool_filetime.o
Removing src/tool_findfile.o
Removing src/tool_formparse.o
Removing src/tool_getparam.o
Removing src/tool_getpass.o
Removing src/tool_help.o
Removing src/tool_helpers.o
Removing src/tool_hugehelp.c
Removing src/tool_hugehelp.o
Removing src/tool_ipfs.o
Removing src/tool_libinfo.o
Removing src/tool_listhelp.o
Removing src/tool_main.o
Removing src/tool_msgs.o
Removing src/tool_operate.o
Removing src/tool_operhlp.o
Removing src/tool_paramhlp.o
Removing src/tool_parsecfg.o
Removing src/tool_progress.o
Removing src/tool_setopt.o
Removing src/tool_sleep.o
Removing src/tool_stderr.o
Removing src/tool_strdup.o
Removing src/tool_urlglob.o
Removing src/tool_util.o
Removing src/tool_vms.o
Removing src/tool_writeout.o
Removing src/tool_writeout_json.o
Removing src/tool_xattr.o
Removing src/var.o
Removing test-driver
Removing tests/Makefile
Removing tests/Makefile.in
Removing tests/certs/Makefile
Removing tests/certs/Makefile.in
Removing tests/certs/scripts/Makefile
Removing tests/certs/scripts/Makefile.in
Removing tests/config
Removing tests/configurehelp.pm
Removing tests/data/Makefile
Removing tests/data/Makefile.in
Removing tests/http/Makefile
Removing tests/http/Makefile.in
Removing tests/http/clients/.deps/
Removing tests/http/clients/Makefile
Removing tests/http/clients/Makefile.in
Removing tests/http/config.ini
Removing tests/libtest/.deps/
Removing tests/libtest/Makefile
Removing tests/libtest/Makefile.in
Removing tests/server/.deps/
Removing tests/server/Makefile
Removing tests/server/Makefile.in
Removing tests/unit/.deps/
Removing tests/unit/Makefile
Removing tests/unit/Makefile.in

$ autoreconf -fi
libtoolize: putting auxiliary files in '.'.
libtoolize: copying file './ltmain.sh'
libtoolize: putting macros in AC_CONFIG_MACRO_DIRS, 'm4'.
libtoolize: copying file 'm4/libtool.m4'
libtoolize: copying file 'm4/ltoptions.m4'
libtoolize: copying file 'm4/ltsugar.m4'
libtoolize: copying file 'm4/ltversion.m4'
libtoolize: copying file 'm4/lt~obsolete.m4'
libtoolize: Remember to add 'LT_INIT' to configure.ac.
configure.ac:123: installing './compile'
configure.ac:424: installing './config.guess'
configure.ac:424: installing './config.sub'
configure.ac:123: installing './install-sh'
configure.ac:129: installing './missing'
docs/examples/Makefile.am: installing './depcomp'
parallel-tests: installing './test-driver'

$ bash -c find . -name config.guess -exec cp /usr/share/misc/config.guess {} \;

$ bash -c find . -name config.sub -exec cp /usr/share/misc/config.sub {} \;

$ chmod +x configure

$ ./configure --disable-shared --without-ssl --disable-docs
checking whether to enable maintainer-specific portions of Makefiles... no
checking whether make supports nested variables... yes
checking whether to enable debug build options... no
checking whether to enable compiler optimizer... (assumed) yes
checking whether to enable strict compiler warnings... no
checking whether to enable compiler warnings as errors... no
checking whether to enable curl debug memory tracking... no
checking whether to enable hiding of library internal symbols... yes
checking whether to enable c-ares for DNS lookups... no
checking whether to disable dependency on -lrt... (assumed no)
checking whether to enable ECH support... no
checking for path separator... :
checking for sed... /usr/bin/sed
checking for grep... /usr/bin/grep
checking that grep -E works... yes
checking for ar... /usr/bin/ar
checking for a BSD-compatible install... /usr/bin/install -c
checking for gcc... ccache gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables...
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether the compiler supports GNU C... yes
checking whether ccache gcc accepts -g... yes
checking for ccache gcc option to enable C11 features... none needed
checking whether ccache gcc understands -c and -o together... yes
checking how to run the C preprocessor... ccache gcc -E
checking for stdio.h... yes
checking for stdlib.h... yes
checking for string.h... yes
checking for inttypes.h... yes
checking for stdint.h... yes
checking for strings.h... yes
checking for sys/stat.h... yes
checking for sys/types.h... yes
checking for unistd.h... yes
checking for stdatomic.h... yes
checking if _Atomic is available... yes
checking for a sed that does not truncate output... (cached) /usr/bin/sed
checking for code coverage support... no
checking whether build environment is sane... yes
checking for a race-free mkdir -p... /usr/bin/mkdir -p
checking for gawk... gawk
checking whether make sets $(MAKE)... yes
checking whether make supports the include directive... yes (GNU style)
checking dependency style of ccache gcc... gcc3
checking curl version... 8.6.0-DEV
checking for httpd... no
checking for apache2... no
checking for apachectl... no
checking for apxs... no
configure: httpd/apache2 not in PATH, http tests disabled
configure: apxs not in PATH, http tests disabled
checking for nghttpx... no
checking for caddy... no
checking build system type... x86_64-pc-linux-gnu
checking host system type... x86_64-pc-linux-gnu
checking for grep that handles long lines and -e... (cached) /usr/bin/grep
checking for egrep... /usr/bin/grep -E
checking if OS is AIX (to define _ALL_SOURCE)... no
checking if _THREAD_SAFE is already defined... no
checking if _THREAD_SAFE is actually needed... no
checking if _THREAD_SAFE is onwards defined... no
checking if _REENTRANT is already defined... no
checking if _REENTRANT is actually needed... no
checking if _REENTRANT is onwards defined... no
checking for special C compiler options needed for large files... no
checking for _FILE_OFFSET_BITS value needed for large files... no
checking how to print strings... printf
checking for a sed that does not truncate output... (cached) /usr/bin/sed
checking for fgrep... /usr/bin/grep -F
checking for ld used by ccache gcc... /usr/bin/ld
checking if the linker (/usr/bin/ld) is GNU ld... yes
checking for BSD- or MS-compatible name lister (nm)... /usr/bin/nm -B
checking the name lister (/usr/bin/nm -B) interface... BSD nm
checking whether ln -s works... yes
checking the maximum length of command line arguments... 1572864
checking how to convert x86_64-pc-linux-gnu file names to x86_64-pc-linux-gnu format... func_convert_file_noop
checking how to convert x86_64-pc-linux-gnu file names to toolchain format... func_convert_file_noop
checking for /usr/bin/ld option to reload object files... -r
checking for objdump... objdump
checking how to recognize dependent libraries... pass_all
checking for dlltool... no
checking how to associate runtime and link libraries... printf %s\n
checking for archiver @FILE support... @
checking for strip... strip
checking for ranlib... ranlib
checking command to parse /usr/bin/nm -B output from ccache gcc object... ok
checking for sysroot... no
checking for a working dd... /usr/bin/dd
checking how to truncate binary pipes... /usr/bin/dd bs=4096 count=1
checking for mt... mt
checking if mt is a manifest tool... no
checking for dlfcn.h... yes
checking for objdir... .libs
checking if ccache gcc supports -fno-rtti -fno-exceptions... no
checking for ccache gcc option to produce PIC... -fPIC -DPIC
checking if ccache gcc PIC flag -fPIC -DPIC works... yes
checking if ccache gcc static flag -static works... yes
checking if ccache gcc supports -c -o file.o... yes
checking if ccache gcc supports -c -o file.o... (cached) yes
checking whether the ccache gcc linker (/usr/bin/ld -m elf_x86_64) supports shared libraries... yes
checking dynamic linker characteristics... GNU/Linux ld.so
checking how to hardcode library paths into programs... immediate
checking whether stripping libraries is possible... yes
checking if libtool supports shared libraries... yes
checking whether to build shared libraries... no
checking whether to build static libraries... yes
checking whether to build shared libraries with -version-info... yes
checking whether to build shared libraries with -no-undefined... no
checking whether to build shared libraries with -mimpure-text... no
checking whether to build shared libraries with PIC... yes
checking whether to build static libraries with PIC... yes
checking whether to build shared libraries only... no
checking whether to build static libraries only... yes
checking for windres... no
checking for inline... inline
checking if cpp -P is needed... yes
checking if cpp -P works... yes
checking if compiler is DEC/Compaq/HP C... no
checking if compiler is HP-UX C... no
checking if compiler is IBM C... no
checking if compiler is Intel C... no
checking if compiler is clang... no
checking if compiler is GNU C... yes
checking compiler version... gcc '1100' (raw: '11')
checking if compiler is SGI MIPSpro C... no
checking if compiler is SGI MIPS C... no
checking if compiler is SunPro C... no
checking if compiler is Tiny C... no
checking whether build target is a native Windows one... no
checking if compiler accepts some basic options... yes
configure: compiler options added: -Werror-implicit-function-declaration
checking if compiler optimizer assumed setting might be used... yes
checking if compiler accepts optimizer enabling options... yes
configure: compiler options added: -O2
checking if compiler accepts strict warning options... yes
configure: compiler options added: -Wno-system-headers
checking if compiler halts on compilation errors... yes
checking if compiler halts on negative sized arrays... yes
checking if compiler halts on function prototype mismatch... yes
checking if compiler supports hiding library internal symbols... yes
checking whether build target supports WIN32 file API... no
checking whether build target supports WIN32 crypto API... no
checking for good-to-use Darwin CFLAGS... no
checking whether to link macOS CoreFoundation, CoreServices, and SystemConfiguration frameworks... no
checking to see if the compiler supports __builtin_available()... no
checking whether to support http... yes
checking whether to support ftp... yes
checking whether to support file... yes
checking whether to support ldap... yes
checking whether to support ldaps... yes
checking whether to support rtsp... yes
checking whether to support proxies... yes
checking whether to support dict... yes
checking whether to support telnet... yes
checking whether to support tftp... yes
checking whether to support pop3... yes
checking whether to support imap... yes
checking whether to support smb... yes
checking whether to support smtp... yes
checking whether to support gopher... yes
checking whether to support mqtt... no
checking whether to provide built-in manual... yes
checking whether to enable generation of C code... yes
checking whether to use libgcc... no
checking if X/Open network library is required... no
checking for gethostbyname... yes
checking whether build target is a native Windows one... (cached) no
checking for proto/bsdsocket.h... no
checking for connect in libraries... yes
checking for sys/types.h... (cached) yes
checking for sys/time.h... yes
checking for monotonic clock_gettime... yes
checking for clock_gettime in libraries... no additional lib required
checking if monotonic clock_gettime works... yes
checking for sys/types.h... (cached) yes
checking for sys/time.h... (cached) yes
checking for raw monotonic clock_gettime... yes
checking for pkg-config... /usr/bin/pkg-config
checking for zlib options with pkg-config... found
checking for zlib.h... yes
configure: found both libz and libz.h header
checking for BrotliDecoderDecompress in -lbrotlidec... no
checking for brotli/decode.h... no
checking for ZSTD_createDStream in -lzstd... no
checking for zstd.h... no
checking for lber.h... no
checking for ldap.h... no
checking for ldap_ssl.h... no
checking for LDAP libraries... cannot find LDAP libraries
checking whether to enable IPv6... yes
checking if struct sockaddr_in6 has sin6_scope_id member... yes
checking if argv can be written to... yes
checking if GSS-API support is requested... no
checking whether to enable Windows native SSL/TLS... no
checking whether to enable Secure Transport... no
checking whether to enable Amiga native SSL/TLS (AmiSSL v5)... no
checking for library containing psl_builtin... -lpsl
checking for library containing gsasl_init... no
checking for RTMP_Init in -lrtmp... no
checking whether versioned symbols are wanted... no
checking whether to enable Windows native IDN (Windows native builds only)... no
checking whether to build with libidn2... (assumed) yes
checking for pkg-config... (cached) /usr/bin/pkg-config
checking for libidn2 options with pkg-config... no
configure: IDN_LIBS: "-lidn2"
configure: IDN_LDFLAGS: ""
configure: IDN_CPPFLAGS: ""
configure: IDN_DIR: ""
checking if idn2_lookup_ul can be linked... no
checking for idn2.h... no
checking for pkg-config... (cached) /usr/bin/pkg-config
checking for libnghttp2 options with pkg-config... no
checking for nghttp2_session_get_stream_local_window_size in -lnghttp2... no
checking for pkg-config... (cached) /usr/bin/pkg-config
checking for fish options with pkg-config... no
checking for sys/types.h... (cached) yes
checking for sys/time.h... (cached) yes
checking for sys/select.h... yes
checking for sys/socket.h... yes
checking for sys/ioctl.h... yes
checking for unistd.h... (cached) yes
checking for stdlib.h... (cached) yes
checking for arpa/inet.h... yes
checking for net/if.h... yes
checking for netinet/in.h... yes
checking for netinet/in6.h... no
checking for sys/un.h... yes
checking for linux/tcp.h... yes
checking for netinet/tcp.h... yes
checking for netinet/udp.h... yes
checking for netdb.h... yes
checking for sys/sockio.h... no
checking for sys/stat.h... (cached) yes
checking for sys/param.h... yes
checking for termios.h... yes
checking for termio.h... yes
checking for fcntl.h... yes
checking for io.h... no
checking for pwd.h... yes
checking for utime.h... yes
checking for sys/utime.h... no
checking for sys/poll.h... yes
checking for poll.h... yes
checking for socket.h... no
checking for sys/resource.h... yes
checking for libgen.h... yes
checking for locale.h... yes
checking for stdbool.h... yes
checking for sys/filio.h... no
checking for sys/wait.h... yes
checking for setjmp.h... yes
checking for an ANSI C-conforming const... yes
checking for size_t... yes
checking for sys/types.h... (cached) yes
checking for sys/time.h... (cached) yes
checking for sys/socket.h... (cached) yes
checking for struct timeval... yes
checking run-time libs availability... fine
checking size of size_t... 8
checking size of long... 8
checking size of int... 4
checking size of time_t... 8
checking size of off_t... 8
checking size of curl_off_t... 8
checking size of curl_socket_t... 4
checking for long long... yes
checking for ssize_t... yes
checking for bool... yes
checking for sa_family_t... yes
checking for suseconds_t... yes
checking if time_t is unsigned... no
checking for in_addr_t... yes
checking for struct sockaddr_storage... yes
checking for sys/select.h... (cached) yes
checking for sys/socket.h... (cached) yes
checking for select... yes
checking for sys/types.h... (cached) yes
checking for sys/socket.h... (cached) yes
checking for recv... yes
checking for sys/types.h... (cached) yes
checking for sys/socket.h... (cached) yes
checking for send... yes
checking for sys/types.h... (cached) yes
checking for sys/socket.h... (cached) yes
checking for MSG_NOSIGNAL... yes
checking for sys/types.h... (cached) yes
checking for unistd.h... (cached) yes
checking if alarm can be linked... yes
checking if alarm is prototyped... yes
checking if alarm is compilable... yes
checking if alarm usage allowed... yes
checking if alarm might be used... yes
checking for sys/types.h... (cached) yes
checking for strings.h... (cached) yes
checking for sys/types.h... (cached) yes
checking for libgen.h... (cached) yes
checking if basename can be linked... yes
checking if basename is prototyped... yes
checking if basename is compilable... yes
checking if basename usage allowed... yes
checking if basename might be used... yes
checking for sys/types.h... (cached) yes
checking for socket.h... (cached) no
checking if closesocket can be linked... no
checking if closesocket might be used... no
checking for sys/types.h... (cached) yes
checking for sys/socket.h... (cached) yes
checking if CloseSocket can be linked... no
checking if CloseSocket might be used... no
checking for sys/types.h... (cached) yes
checking for unistd.h... (cached) yes
checking for fcntl.h... (cached) yes
checking if fcntl can be linked... yes
checking if fcntl is prototyped... yes
checking if fcntl is compilable... yes
checking if fcntl usage allowed... yes
checking if fcntl might be used... yes
checking if fcntl O_NONBLOCK is compilable... yes
checking if fcntl O_NONBLOCK usage allowed... yes
checking if fcntl O_NONBLOCK might be used... yes
checking whether build target is a native Windows one... (cached) no
checking for sys/types.h... (cached) yes
checking for netdb.h... (cached) yes
checking if freeaddrinfo can be linked... yes
checking if freeaddrinfo is prototyped... yes
checking if freeaddrinfo is compilable... yes
checking if freeaddrinfo usage allowed... yes
checking if freeaddrinfo might be used... yes
checking for sys/types.h... (cached) yes
checking for sys/xattr.h... yes
checking if fsetxattr can be linked... yes
checking if fsetxattr is prototyped... yes
checking if fsetxattr takes 5 args.... yes
checking if fsetxattr is compilable... yes
checking if fsetxattr usage allowed... yes
checking if fsetxattr might be used... yes
checking if ftruncate can be linked... yes
checking if ftruncate is prototyped... yes
checking if ftruncate is compilable... yes
checking if ftruncate usage allowed... yes
checking if ftruncate might be used... yes
checking for sys/types.h... (cached) yes
checking if getaddrinfo can be linked... yes
checking if getaddrinfo is prototyped... yes
checking if getaddrinfo is compilable... yes
checking if getaddrinfo seems to work... yes
checking if getaddrinfo usage allowed... yes
checking if getaddrinfo might be used... yes
checking if getaddrinfo is threadsafe... yes
checking if gethostbyname can be linked... yes
checking if gethostbyname is prototyped... yes
checking if gethostbyname is compilable... yes
checking if gethostbyname usage allowed... yes
checking if gethostbyname might be used... yes
checking if gethostbyname_r can be linked... yes
checking if gethostbyname_r is prototyped... yes
checking if gethostbyname_r takes 3 args.... no
checking if gethostbyname_r takes 5 args.... no
checking if gethostbyname_r takes 6 args.... yes
checking if gethostbyname_r is compilable... yes
checking if gethostbyname_r usage allowed... yes
checking if gethostbyname_r might be used... yes
checking if gethostname can be linked... yes
checking if gethostname is prototyped... yes
checking if gethostname is compilable... yes
checking for gethostname arg 2 data type... size_t
checking if gethostname usage allowed... yes
checking if gethostname might be used... yes
checking if getpeername can be linked... yes
checking if getpeername is prototyped... yes
checking if getpeername is compilable... yes
checking if getpeername usage allowed... yes
checking if getpeername might be used... yes
checking if getsockname can be linked... yes
checking if getsockname is prototyped... yes
checking if getsockname is compilable... yes
checking if getsockname usage allowed... yes
checking if getsockname might be used... yes
checking for net/if.h... (cached) yes
checking if if_nametoindex can be linked... yes
checking if if_nametoindex is prototyped... yes
checking if if_nametoindex is compilable... yes
checking if if_nametoindex usage allowed... yes
checking if if_nametoindex might be used... yes
checking for sys/types.h... (cached) yes
checking for sys/socket.h... (cached) yes
checking for netinet/in.h... (cached) yes
checking for ifaddrs.h... yes
checking if getifaddrs can be linked... yes
checking if getifaddrs is prototyped... yes
checking if getifaddrs is compilable... yes
checking if getifaddrs seems to work... yes
checking if getifaddrs usage allowed... yes
checking if getifaddrs might be used... yes
checking for sys/types.h... (cached) yes
checking for sys/time.h... (cached) yes
checking if gmtime_r can be linked... yes
checking if gmtime_r is prototyped... yes
checking if gmtime_r is compilable... yes
checking if gmtime_r seems to work... yes
checking if gmtime_r usage allowed... yes
checking if gmtime_r might be used... yes
checking for sys/types.h... (cached) yes
checking for sys/socket.h... (cached) yes
checking for netinet/in.h... (cached) yes
checking for arpa/inet.h... (cached) yes
checking if inet_ntop can be linked... yes
checking if inet_ntop is prototyped... yes
checking if inet_ntop is compilable... yes
checking if inet_ntop seems to work... yes
checking if inet_ntop usage allowed... yes
checking if inet_ntop might be used... yes
checking if inet_pton can be linked... yes
checking if inet_pton is prototyped... yes
checking if inet_pton is compilable... yes
checking if inet_pton seems to work... yes
checking if inet_pton usage allowed... yes
checking if inet_pton might be used... yes
checking for sys/types.h... (cached) yes
checking for unistd.h... (cached) yes
checking for sys/socket.h... (cached) yes
checking for sys/ioctl.h... (cached) yes
checking for stropts.h... no
checking if ioctl can be linked... yes
checking if ioctl is prototyped... yes
checking if ioctl is compilable... yes
checking if ioctl usage allowed... yes
checking if ioctl might be used... yes
checking if ioctl FIONBIO is compilable... yes
checking if ioctl FIONBIO usage allowed... yes
checking if ioctl FIONBIO might be used... yes
checking if ioctl SIOCGIFADDR is compilable... yes
checking if ioctl SIOCGIFADDR usage allowed... yes
checking if ioctl SIOCGIFADDR might be used... yes
checking if ioctlsocket can be linked... no
checking if ioctlsocket might be used... no
checking if IoctlSocket can be linked... no
checking if IoctlSocket might be used... no
checking if memrchr can be linked... yes
checking if memrchr is prototyped... no
checking if memrchr might be used... no
checking for sys/types.h... (cached) yes
checking for poll.h... (cached) yes
checking for sys/poll.h... (cached) yes
checking if poll can be linked... yes
checking if poll is prototyped... yes
checking if poll is compilable... yes
checking if poll seems to work... yes
checking if poll usage allowed... yes
checking if poll might be used... yes
checking for sys/types.h... (cached) yes
checking if sigaction can be linked... yes
checking if sigaction is prototyped... yes
checking if sigaction is compilable... yes
checking if sigaction usage allowed... yes
checking if sigaction might be used... yes
checking if siginterrupt can be linked... yes
checking if siginterrupt is prototyped... yes
checking if siginterrupt is compilable... yes
checking if siginterrupt usage allowed... yes
checking if siginterrupt might be used... yes
checking if signal can be linked... yes
checking if signal is prototyped... yes
checking if signal is compilable... yes
checking if signal usage allowed... yes
checking if signal might be used... yes
checking for sys/types.h... (cached) yes
checking if sigsetjmp can be linked... no
checking if sigsetjmp seems a macro... yes
checking if sigsetjmp is compilable... yes
checking if sigsetjmp usage allowed... yes
checking if sigsetjmp might be used... yes
checking if socket can be linked... yes
checking if socket is prototyped... yes
checking if socket is compilable... yes
checking if socket usage allowed... yes
checking if socket might be used... yes
checking if socketpair can be linked... yes
checking if socketpair is prototyped... yes
checking if socketpair is compilable... yes
checking if socketpair usage allowed... yes
checking if socketpair might be used... yes
checking if strcasecmp can be linked... yes
checking if strcasecmp is prototyped... yes
checking if strcasecmp is compilable... yes
checking if strcasecmp usage allowed... yes
checking if strcasecmp might be used... yes
checking if strcmpi can be linked... no
checking if strcmpi might be used... no
checking if strdup can be linked... yes
checking if strdup is prototyped... yes
checking if strdup is compilable... yes
checking if strdup usage allowed... yes
checking if strdup might be used... yes
checking if strerror_r can be linked... yes
checking if strerror_r is prototyped... yes
checking if strerror_r is compilable... yes
checking if strerror_r is glibc like... no
checking if strerror_r is POSIX like... yes
checking if strerror_r seems to work... yes
checking if strerror_r usage allowed... yes
checking if strerror_r might be used... yes
checking if stricmp can be linked... no
checking if stricmp might be used... no
checking if strtok_r can be linked... yes
checking if strtok_r is prototyped... yes
checking if strtok_r is compilable... yes
checking if strtok_r usage allowed... yes
checking if strtok_r might be used... yes
checking if strtoll can be linked... yes
checking if strtoll is prototyped... yes
checking if strtoll is compilable... yes
checking if strtoll usage allowed... yes
checking if strtoll might be used... yes
checking for ccache gcc options needed to detect all undeclared functions... none needed
checking whether getpwuid_r is declared... yes
checking for _fseeki64... no
checking deeper for _fseeki64... but still no
checking for arc4random... no
checking deeper for arc4random... but still no
checking for fnmatch... yes
checking for fseeko... yes
checking for geteuid... yes
checking for getpass_r... no
checking deeper for getpass_r... but still no
checking for getppid... yes
checking for getpwuid... yes
checking for getpwuid_r... yes
checking for getrlimit... yes
checking for gettimeofday... yes
checking for if_nametoindex... yes
checking for mach_absolute_time... no
checking deeper for mach_absolute_time... but still no
checking for pipe... yes
checking for sched_yield... yes
checking for sendmsg... yes
checking for setlocale... yes
checking for setmode... no
checking deeper for setmode... but still no
checking for setrlimit... yes
checking for snprintf... yes
checking for utime... yes
checking for utimes... yes
checking whether fseeko is declared... yes
checking how to set a socket into non-blocking mode... fcntl O_NONBLOCK
checking for perl... /usr/bin/perl
checking for gnroff... no
checking for nroff... /usr/bin/nroff
checking how to use *nroff to get plain text from man pages... -man
checking whether to enable the threaded resolver... yes
checking whether to use POSIX threads for threaded resolver... auto
checking for pthread.h... yes
checking for pthread_create... yes
checking convert -I options to -isystem... yes
checking whether to enable verbose strings... yes
checking whether to enable SSPI support (Windows native builds only)... no
checking whether to enable basic authentication method... yes
checking whether to enable bearer authentication method... yes
checking whether to enable digest authentication method... yes
checking whether to enable kerberos authentication method... yes
checking whether to enable negotiate authentication method... yes
checking whether to enable aws sig methods... yes
checking whether to support NTLM... yes
checking whether to enable NTLM delegation to winbind's helper... no
checking whether to enable TLS-SRP authentication... yes
checking whether to enable Unix domain sockets... auto
checking for struct sockaddr_un.sun_path... yes
checking whether to support cookies... yes
checking whether to support socketpair... yes
checking whether to support HTTP authentication... yes
checking whether to support DoH... yes
checking whether to support the MIME API... yes
checking whether to support binding connections locally... yes
checking whether to support the form API... yes
checking whether to support date parsing... yes
checking whether to support netrc parsing... yes
checking whether to support progress-meter... yes
checking whether to support DNS shuffling... yes
checking whether to support curl_easy_option*... yes
checking whether to support alt-svc... yes
checking whether to support headers-api... yes
configure: disables HSTS due to lack of SSL
checking whether to support WebSockets... no
checking whether hiding of library internal symbols will actually happen... yes
checking if this build supports HTTPS-proxy... no
checking that generated files are newer than configure... done
configure: creating ./config.status
config.status: creating Makefile
config.status: creating docs/Makefile
config.status: creating docs/examples/Makefile
config.status: creating docs/libcurl/Makefile
config.status: creating docs/libcurl/opts/Makefile
config.status: creating docs/cmdline-opts/Makefile
config.status: creating include/Makefile
config.status: creating include/curl/Makefile
config.status: creating src/Makefile
config.status: creating lib/Makefile
config.status: creating scripts/Makefile
config.status: creating lib/libcurl.vers
config.status: creating lib/libcurl.plist
config.status: creating tests/Makefile
config.status: creating tests/config
config.status: creating tests/certs/Makefile
config.status: creating tests/certs/scripts/Makefile
config.status: creating tests/data/Makefile
config.status: creating tests/server/Makefile
config.status: creating tests/libtest/Makefile
config.status: creating tests/unit/Makefile
config.status: creating tests/http/config.ini
config.status: creating tests/http/Makefile
config.status: creating tests/http/clients/Makefile
config.status: creating packages/Makefile
config.status: creating packages/vms/Makefile
config.status: creating curl-config
config.status: creating libcurl.pc
config.status: creating lib/curl_config.h
config.status: executing depfiles commands
config.status: executing libtool commands
configure: Configured to build curl/libcurl:

Host setup: x86_64-pc-linux-gnu
Install prefix: /usr/local
Compiler: ccache gcc
CFLAGS: -Werror-implicit-function-declaration -O2 -Wno-system-headers
CPPFLAGS:
LDFLAGS:
LIBS: -lpsl -lz

curl version: 8.6.0-DEV
SSL: no (--with-{openssl,gnutls,mbedtls,wolfssl,schannel,secure-transport,amissl,bearssl,rustls} )
SSH: no (--with-{libssh,libssh2})
zlib: enabled
brotli: no (--with-brotli)
zstd: no (--with-zstd)
GSS-API: no (--with-gssapi)
GSASL: no (libgsasl not found)
TLS-SRP: no (--enable-tls-srp)
resolver: POSIX threaded
IPv6: enabled
Unix sockets: enabled
IDN: no (--with-{libidn2,winidn})
Build libcurl: Shared=no, Static=yes
Built-in manual: enabled
--libcurl option: enabled (--disable-libcurl-option)
Verbose errors: enabled (--disable-verbose)
Code coverage: disabled
SSPI: no (--enable-sspi)
ca cert bundle: no
ca cert path:
ca fallback:
LDAP: no (--enable-ldap / --with-ldap-lib / --with-lber-lib)
LDAPS: no (--enable-ldaps)
RTSP: enabled
RTMP: no (--with-librtmp)
PSL: enabled
Alt-svc: enabled (--disable-alt-svc)
Headers API: enabled (--disable-headers-api)
HSTS: no (--enable-hsts)
HTTP1: enabled (internal)
HTTP2: no (--with-nghttp2)
HTTP3: no (--with-ngtcp2 --with-nghttp3, --with-quiche, --with-msh3)
ECH: no (--enable-ech)
WebSockets: no (--enable-websockets)
Protocols: DICT FILE FTP GOPHER HTTP IMAP IPFS IPNS MQTT POP3 RTSP SMTP TELNET TFTP
Features: AsynchDNS IPv6 Largefile PSL UnixSockets alt-svc libz threadsafe

configure: WARNING: unrecognized options: --disable-docs
configure: WARNING: Cannot find libraries for LDAP support: LDAP disabled
configure: WARNING: libgsasl was not found
configure: WARNING: Cannot find libraries for IDN support: IDN disabled
configure: WARNING: unrecognized options: --disable-docs

$ make -j3
Making all in lib
make[1]: Entering directory '/root/asi_db/builds/curl/_worktrees/w0/lib'
make all-am
make[2]: Entering directory '/root/asi_db/builds/curl/_worktrees/w0/lib'
CC libcurl_la-altsvc.lo
CC libcurl_la-asyn-ares.lo
CC libcurl_la-amigaos.lo
CC libcurl_la-asyn-thread.lo
CC libcurl_la-base64.lo
CC libcurl_la-bufq.lo
CC libcurl_la-bufref.lo
CC libcurl_la-c-hyper.lo
CC libcurl_la-cf-h1-proxy.lo
CC libcurl_la-cf-h2-proxy.lo
CC libcurl_la-cf-haproxy.lo
CC libcurl_la-cf-https-connect.lo
CC libcurl_la-cf-socket.lo
CC libcurl_la-cfilters.lo
CC libcurl_la-conncache.lo
CC libcurl_la-connect.lo
CC libcurl_la-content_encoding.lo
CC libcurl_la-cookie.lo
CC libcurl_la-curl_des.lo
CC libcurl_la-curl_addrinfo.lo
CC libcurl_la-curl_endian.lo
CC libcurl_la-curl_fnmatch.lo
CC libcurl_la-curl_get_line.lo
CC libcurl_la-curl_gethostname.lo
CC libcurl_la-curl_gssapi.lo
CC libcurl_la-curl_memrchr.lo
CC libcurl_la-curl_multibyte.lo
CC libcurl_la-curl_ntlm_core.lo
CC libcurl_la-curl_ntlm_wb.lo
CC libcurl_la-curl_path.lo
CC libcurl_la-curl_range.lo
CC libcurl_la-curl_rtmp.lo
CC libcurl_la-curl_sasl.lo
CC libcurl_la-curl_sspi.lo
CC libcurl_la-curl_threads.lo
CC libcurl_la-curl_trc.lo
CC libcurl_la-dict.lo
CC libcurl_la-doh.lo
CC libcurl_la-dynbuf.lo
CC libcurl_la-dynhds.lo
CC libcurl_la-easy.lo
CC libcurl_la-easygetopt.lo
CC libcurl_la-easyoptions.lo
CC libcurl_la-escape.lo
CC libcurl_la-file.lo
CC libcurl_la-fileinfo.lo
CC libcurl_la-fopen.lo
CC libcurl_la-formdata.lo
CC libcurl_la-ftp.lo
CC libcurl_la-ftplistparser.lo
CC libcurl_la-getenv.lo
CC libcurl_la-getinfo.lo
CC libcurl_la-gopher.lo
CC libcurl_la-hash.lo
CC libcurl_la-headers.lo
CC libcurl_la-hmac.lo
CC libcurl_la-hostasyn.lo
CC libcurl_la-hostip.lo
CC libcurl_la-hostip4.lo
CC libcurl_la-hostip6.lo
CC libcurl_la-hostsyn.lo
CC libcurl_la-hsts.lo
CC libcurl_la-http.lo
CC libcurl_la-http2.lo
CC libcurl_la-http1.lo
CC libcurl_la-http_aws_sigv4.lo
CC libcurl_la-http_chunks.lo
CC libcurl_la-http_digest.lo
CC libcurl_la-http_negotiate.lo
CC libcurl_la-http_ntlm.lo
CC libcurl_la-http_proxy.lo
CC libcurl_la-idn.lo
CC libcurl_la-if2ip.lo
CC libcurl_la-imap.lo
CC libcurl_la-inet_ntop.lo
CC libcurl_la-inet_pton.lo
CC libcurl_la-krb5.lo
CC libcurl_la-ldap.lo
CC libcurl_la-llist.lo
CC libcurl_la-macos.lo
CC libcurl_la-md4.lo
CC libcurl_la-md5.lo
CC libcurl_la-memdebug.lo
CC libcurl_la-mime.lo
CC libcurl_la-mprintf.lo
CC libcurl_la-mqtt.lo
CC libcurl_la-multi.lo
CC libcurl_la-netrc.lo
CC libcurl_la-nonblock.lo
CC libcurl_la-noproxy.lo
CC libcurl_la-openldap.lo
CC libcurl_la-parsedate.lo
CC libcurl_la-pingpong.lo
CC libcurl_la-pop3.lo
CC libcurl_la-progress.lo
CC libcurl_la-psl.lo
CC libcurl_la-rand.lo
CC libcurl_la-rename.lo
CC libcurl_la-rtsp.lo
CC libcurl_la-select.lo
CC libcurl_la-sendf.lo
CC libcurl_la-setopt.lo
CC libcurl_la-sha256.lo
CC libcurl_la-share.lo
CC libcurl_la-slist.lo
CC libcurl_la-smb.lo
CC libcurl_la-smtp.lo
CC libcurl_la-socketpair.lo
CC libcurl_la-socks.lo
CC libcurl_la-socks_gssapi.lo
CC libcurl_la-socks_sspi.lo
CC libcurl_la-speedcheck.lo
CC libcurl_la-splay.lo
CC libcurl_la-strcase.lo
CC libcurl_la-strdup.lo
CC libcurl_la-strerror.lo
CC libcurl_la-strtok.lo
CC libcurl_la-strtoofft.lo
CC libcurl_la-system_win32.lo
CC libcurl_la-telnet.lo
CC libcurl_la-tftp.lo
CC libcurl_la-timediff.lo
CC libcurl_la-timeval.lo
CC libcurl_la-transfer.lo
CC libcurl_la-url.lo
CC libcurl_la-urlapi.lo
CC libcurl_la-version.lo
CC libcurl_la-version_win32.lo
CC libcurl_la-warnless.lo
CC libcurl_la-ws.lo
CC vauth/libcurl_la-cleartext.lo
CC vauth/libcurl_la-cram.lo
CC vauth/libcurl_la-digest.lo
CC vauth/libcurl_la-digest_sspi.lo
CC vauth/libcurl_la-gsasl.lo
CC vauth/libcurl_la-krb5_gssapi.lo
CC vauth/libcurl_la-krb5_sspi.lo
CC vauth/libcurl_la-ntlm.lo
CC vauth/libcurl_la-ntlm_sspi.lo
CC vauth/libcurl_la-oauth2.lo
CC vauth/libcurl_la-spnego_gssapi.lo
CC vauth/libcurl_la-spnego_sspi.lo
CC vauth/libcurl_la-vauth.lo
CC vtls/libcurl_la-bearssl.lo
CC vtls/libcurl_la-gtls.lo
CC vtls/libcurl_la-hostcheck.lo
CC vtls/libcurl_la-keylog.lo
CC vtls/libcurl_la-mbedtls.lo
CC vtls/libcurl_la-mbedtls_threadlock.lo
CC vtls/libcurl_la-openssl.lo
CC vtls/libcurl_la-rustls.lo
CC vtls/libcurl_la-schannel.lo
CC vtls/libcurl_la-schannel_verify.lo
CC vtls/libcurl_la-sectransp.lo
CC vtls/libcurl_la-vtls.lo
CC vtls/libcurl_la-wolfssl.lo
CC vtls/libcurl_la-x509asn1.lo
CC vquic/libcurl_la-curl_msh3.lo
CC vquic/libcurl_la-curl_ngtcp2.lo
CC vquic/libcurl_la-curl_quiche.lo
CC vquic/libcurl_la-vquic.lo
CC vquic/libcurl_la-vquic-tls.lo
CC vssh/libcurl_la-libssh.lo
CC vssh/libcurl_la-libssh2.lo
CC vssh/libcurl_la-wolfssh.lo
CCLD libcurl.la
make[2]: Leaving directory '/root/asi_db/builds/curl/_worktrees/w0/lib'
make[1]: Leaving directory '/root/asi_db/builds/curl/_worktrees/w0/lib'
Making all in src
make[1]: Entering directory '/root/asi_db/builds/curl/_worktrees/w0/src'
Making all in ../docs
make[2]: Entering directory '/root/asi_db/builds/curl/_worktrees/w0/docs'
Making all in .
make[3]: Entering directory '/root/asi_db/builds/curl/_worktrees/w0/docs'
if test "..x" != "..x" -a -e "./curl.1"; then \
/usr/bin/install -c -m 644 "./curl.1" /root/asi_db/builds/curl/_worktrees/w0/docs/curl.1 \
&& touch -r "./curl.1" /root/asi_db/builds/curl/_worktrees/w0/docs/curl.1; fi
cd cmdline-opts && make
make[4]: Entering directory '/root/asi_db/builds/curl/_worktrees/w0/docs/cmdline-opts'
GENERATE ../../docs/curl.1
make[4]: Leaving directory '/root/asi_db/builds/curl/_worktrees/w0/docs/cmdline-opts'
make[3]: Leaving directory '/root/asi_db/builds/curl/_worktrees/w0/docs'
Making all in cmdline-opts
make[3]: Entering directory '/root/asi_db/builds/curl/_worktrees/w0/docs/cmdline-opts'
make[3]: Nothing to be done for 'all'.
make[3]: Leaving directory '/root/asi_db/builds/curl/_worktrees/w0/docs/cmdline-opts'
make[2]: Leaving directory '/root/asi_db/builds/curl/_worktrees/w0/docs'
make[2]: Entering directory '/root/asi_db/builds/curl/_worktrees/w0/src'
CC slist_wc.o
CC tool_binmode.o
CC tool_bname.o
CC tool_cb_dbg.o
CC tool_cb_hdr.o
CC tool_cb_prg.o
CC tool_cb_rea.o
CC tool_cb_see.o
CC tool_cb_wrt.o
CC tool_cfgable.o
CC tool_dirhie.o
CC tool_doswin.o
CC tool_easysrc.o
CC tool_filetime.o
CC tool_findfile.o
CC tool_formparse.o
CC tool_getparam.o
CC tool_getpass.o
CC tool_help.o
CC tool_helpers.o
HUGE tool_hugehelp.c
CC tool_ipfs.o
CC tool_libinfo.o
CC tool_listhelp.o
CC tool_main.o
CC tool_msgs.o
CC tool_operate.o
CC tool_operhlp.o
CC tool_paramhlp.o
CC tool_parsecfg.o
CC tool_progress.o
CC tool_setopt.o
CC tool_sleep.o
CC tool_stderr.o
CC tool_strdup.o
CC tool_urlglob.o
CC tool_util.o
CC tool_vms.o
CC tool_writeout.o
CC tool_writeout_json.o
CC tool_xattr.o
CC var.o
CC tool_hugehelp.o
CC ../lib/base64.o
CC ../lib/curl_multibyte.o
CC ../lib/dynbuf.o
CC ../lib/nonblock.o
CC ../lib/strtoofft.o
CC ../lib/timediff.o
CC ../lib/version_win32.o
CC ../lib/warnless.o
CCLD curl
make[2]: Leaving directory '/root/asi_db/builds/curl/_worktrees/w0/src'
make[1]: Leaving directory '/root/asi_db/builds/curl/_worktrees/w0/src'
make[1]: Entering directory '/root/asi_db/builds/curl/_worktrees/w0'
make[1]: Nothing to be done for 'all-am'.
make[1]: Leaving directory '/root/asi_db/builds/curl/_worktrees/w0'

Commit Diff GitHub →

lib/Makefile.inc +4 -2 lib/cf-socket.c +11 -31 lib/vquic/curl_ngtcp2.c +48 -503 lib/vquic/curl_quiche.c +51 -186 lib/vquic/vquic-tls.c +603 -0 lib/vquic/vquic-tls.h +98 -0 lib/vquic/vquic.c +6 -1 lib/vquic/vquic_int.h +3 -1 tests/http/test_01_basic.py +15 -0

lib/Makefile.inc+4 -2

@@ -79,14 +79,16 @@ LIB_VQUIC_CFILES = \
	vquic/curl_msh3.c \
	vquic/curl_ngtcp2.c \
	vquic/curl_quiche.c \
-	vquic/vquic.c
+	vquic/vquic.c \
+	vquic/vquic-tls.c

	LIB_VQUIC_HFILES = \
	vquic/curl_msh3.h \
	vquic/curl_ngtcp2.h \
	vquic/curl_quiche.h \
	vquic/vquic.h \
-	vquic/vquic_int.h
+	vquic/vquic_int.h \
+	vquic/vquic-tls.h

	LIB_VSSH_CFILES = \
	vssh/libssh.c \

lib/cf-socket.c+11 -31

@@ -788,6 +788,7 @@ struct cf_socket_ctx {
	#endif
	BIT(got_first_byte); /* if first byte was received */
	BIT(accepted); /* socket was accepted, not connected */
+	BIT(sock_connected); /* socket is "connected", e.g. in UDP */
	BIT(active);
	BIT(buffer_recv);
	};
@@ -1053,7 +1054,7 @@ static CURLcode cf_socket_open(struct Curl_cfilter *cf,

	/* set socket non-blocking */
	(void)curlx_nonblock(ctx->sock, TRUE);
-
+	ctx->sock_connected = (ctx->addr.socktype != SOCK_DGRAM);
	out:
	if(result) {
	if(ctx->sock != CURL_SOCKET_BAD) {
@@ -1241,11 +1242,14 @@ static void cf_socket_adjust_pollset(struct Curl_cfilter *cf,
	struct cf_socket_ctx *ctx = cf->ctx;

	if(ctx->sock != CURL_SOCKET_BAD) {
-	if(!cf->connected)
+	if(!cf->connected) {
	Curl_pollset_set_out_only(data, ps, ctx->sock);
-	else if(!ctx->active)
+	CURL_TRC_CF(data, cf, "adjust_pollset(!connected) -> %d socks", ps->num);
+	}
+	else if(!ctx->active) {
	Curl_pollset_add_in(data, ps, ctx->sock);
-	CURL_TRC_CF(data, cf, "adjust_pollset -> %d socks", ps->num);
+	CURL_TRC_CF(data, cf, "adjust_pollset(!active) -> %d socks", ps->num);
+	}
	}
	}

@@ -1428,36 +1432,11 @@ out:
	static void conn_set_primary_ip(struct Curl_cfilter *cf,
	struct Curl_easy *data)
	{
-	#ifdef HAVE_GETPEERNAME
	struct cf_socket_ctx *ctx = cf->ctx;
-	if(!(data->conn->handler->protocol & CURLPROTO_TFTP)) {
-	/* TFTP does not connect the endpoint: getpeername() failed with errno
-	107: Transport endpoint is not connected */

-	char buffer[STRERROR_LEN];
-	struct Curl_sockaddr_storage ssrem;
-	curl_socklen_t plen;
-	int port;
-
-	plen = sizeof(ssrem);
-	memset(&ssrem, 0, plen);
-	if(getpeername(ctx->sock, (struct sockaddr*) &ssrem, &plen)) {
-	int error = SOCKERRNO;
-	failf(data, "getpeername() failed with errno %d: %s",
-	error, Curl_strerror(error, buffer, sizeof(buffer)));
-	return;
-	}
-	if(!Curl_addr2string((struct sockaddr*)&ssrem, plen,
-	cf->conn->primary_ip, &port)) {
-	failf(data, "ssrem inet_ntop() failed with errno %d: %s",
-	errno, Curl_strerror(errno, buffer, sizeof(buffer)));
-	return;
-	}
-	}
-	#else
-	cf->conn->primary_ip[0] = 0;
	(void)data;
-	#endif
+	DEBUGASSERT(sizeof(ctx->r_ip) == sizeof(cf->conn->primary_ip));
+	memcpy(cf->conn->primary_ip, ctx->r_ip, sizeof(cf->conn->primary_ip));
	}

	static void cf_socket_active(struct Curl_cfilter cf, struct Curl_easy data)
@@ -1651,6 +1630,7 @@ static CURLcode cf_udp_setup_quic(struct Curl_cfilter *cf,
	if(-1 == rc) {
	return socket_connect_result(data, ctx->r_ip, SOCKERRNO);
	}
+	ctx->sock_connected = TRUE;
	set_local_ip(cf, data);
	CURL_TRC_CF(data, cf, "%s socket %" CURL_FORMAT_SOCKET_T
	" connected: [%s:%d] -> [%s:%d]",

lib/vquic/curl_ngtcp2.c+48 -503

@@ -41,7 +41,6 @@
	#include "vtls/gtls.h"
	#elif defined(USE_WOLFSSL)
	#include <ngtcp2/ngtcp2_crypto_wolfssl.h>
-	#include "vtls/wolfssl.h"
	#endif

	#include "urldata.h"
@@ -61,6 +60,7 @@
	#include "inet_pton.h"
	#include "vquic.h"
	#include "vquic_int.h"
+	#include "vquic-tls.h"
	#include "vtls/keylog.h"
	#include "vtls/vtls.h"
	#include "curl_ngtcp2.h"
@@ -73,9 +73,6 @@
	#include "memdebug.h"


-	#define H3_ALPN_H3_29 "\x5h3-29"
-	#define H3_ALPN_H3 "\x2h3"
-
	#define QUIC_MAX_STREAMS (256*1024)
	#define QUIC_MAX_DATA (110241024)
	#define QUIC_HANDSHAKE_TIMEOUT (10*NGTCP2_SECONDS)
@@ -101,25 +98,6 @@
	(H3_STREAM_WINDOW_SIZE / H3_STREAM_CHUNK_SIZE)


-	#ifdef USE_OPENSSL
-	#define QUIC_CIPHERS \
-	"TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_" \
-	"POLY1305_SHA256:TLS_AES_128_CCM_SHA256"
-	#define QUIC_GROUPS "P-256:X25519:P-384:P-521"
-	#elif defined(USE_GNUTLS)
-	#define QUIC_PRIORITY \
-	"NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-128-GCM:+AES-256-GCM:" \
-	"+CHACHA20-POLY1305:+AES-128-CCM:-GROUP-ALL:+GROUP-SECP256R1:" \
-	"+GROUP-X25519:+GROUP-SECP384R1:+GROUP-SECP521R1:" \
-	"%DISABLE_TLS13_COMPAT_MODE"
-	#elif defined(USE_WOLFSSL)
-	#define QUIC_CIPHERS \
-	"TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_" \
-	"POLY1305_SHA256:TLS_AES_128_CCM_SHA256"
-	#define QUIC_GROUPS "P-256:P-384:P-521"
-	#endif
-
-
	/*
	* Store ngtcp2 version info in this buffer.
	*/
@@ -134,6 +112,7 @@ void Curl_ngtcp2_ver(char *p, size_t len)
	struct cf_ngtcp2_ctx {
	struct cf_quic_ctx q;
	struct ssl_peer peer;
+	struct quic_tls_ctx tls;
	ngtcp2_path connected_path;
	ngtcp2_conn *qconn;
	ngtcp2_cid dcid;
@@ -143,30 +122,16 @@ struct cf_ngtcp2_ctx {
	ngtcp2_transport_params transport_params;
	ngtcp2_ccerr last_error;
	ngtcp2_crypto_conn_ref conn_ref;
-	#ifdef USE_OPENSSL
-	SSL_CTX *sslctx;
-	SSL *ssl;
-	#elif defined(USE_GNUTLS)
-	struct gtls_instance *gtls;
-	#elif defined(USE_WOLFSSL)
-	WOLFSSL_CTX *sslctx;
-	WOLFSSL *ssl;
-	#endif
	struct cf_call_data call_data;
	nghttp3_conn *h3conn;
	nghttp3_settings h3settings;
	struct curltime started_at; /* time the current attempt started */
	struct curltime handshake_at; /* time connect handshake finished */
-	struct curltime first_byte_at; /* when first byte was recvd */
	struct curltime reconnect_at; /* time the next attempt should start */
	struct bufc_pool stream_bufcp; /* chunk pool for streams */
	size_t max_stream_window; /* max flow window for one stream */
	uint64_t max_idle_ms; /* max idle time for QUIC connection */
	int qlogfd;
-	BIT(got_first_byte); /* if first byte was received */
-	#ifdef USE_OPENSSL
-	BIT(x509_store_setup); /* if x509 store has been set up */
-	#endif
	};

	/* How to access `call_data` from a cf_ngtcp2 filter */
@@ -413,388 +378,8 @@ static void quic_settings(struct cf_ngtcp2_ctx *ctx,
	}
	}

-	#ifdef USE_OPENSSL
-	static void keylog_callback(const SSL ssl, const char line)
-	{
-	(void)ssl;
-	Curl_tls_keylog_write_line(line);
-	}
-	#elif defined(USE_GNUTLS)
-	static int keylog_callback(gnutls_session_t session, const char *label,
-	const gnutls_datum_t *secret)
-	{
-	gnutls_datum_t crandom;
-	gnutls_datum_t srandom;
-
-	gnutls_session_get_random(session, &crandom, &srandom);
-	if(crandom.size != 32) {
-	return -1;
-	}
-
-	Curl_tls_keylog_write(label, crandom.data, secret->data, secret->size);
-	return 0;
-	}
-	#elif defined(USE_WOLFSSL)
-	#if defined(HAVE_SECRET_CALLBACK)
-	static void keylog_callback(const WOLFSSL ssl, const char line)
-	{
-	(void)ssl;
-	Curl_tls_keylog_write_line(line);
-	}
-	#endif
-	#endif
-
	static int init_ngh3_conn(struct Curl_cfilter *cf);

-	#ifdef USE_OPENSSL
-	static CURLcode quic_ssl_ctx(SSL_CTX **pssl_ctx,
-	struct Curl_cfilter cf, struct Curl_easy data)
-	{
-	struct cf_ngtcp2_ctx *ctx = cf->ctx;
-	struct ssl_primary_config *conn_config;
-	CURLcode result = CURLE_FAILED_INIT;
-
-	SSL_CTX *ssl_ctx = SSL_CTX_new(TLS_method());
-	if(!ssl_ctx) {
-	result = CURLE_OUT_OF_MEMORY;
-	goto out;
-	}
-	conn_config = Curl_ssl_cf_get_primary_config(cf);
-	if(!conn_config) {
-	result = CURLE_FAILED_INIT;
-	goto out;
-	}
-
-	#if defined(OPENSSL_IS_BORINGSSL) \|\| defined(OPENSSL_IS_AWSLC)
-	if(ngtcp2_crypto_boringssl_configure_client_context(ssl_ctx) != 0) {
-	failf(data, "ngtcp2_crypto_boringssl_configure_client_context failed");
-	goto out;
-	}
-	#else
-	if(ngtcp2_crypto_quictls_configure_client_context(ssl_ctx) != 0) {
-	failf(data, "ngtcp2_crypto_quictls_configure_client_context failed");
-	goto out;
-	}
-	#endif
-
-	SSL_CTX_set_default_verify_paths(ssl_ctx);
-
-	{
-	const char *curves = conn_config->curves ?
-	conn_config->curves : QUIC_GROUPS;
-	if(!SSL_CTX_set1_curves_list(ssl_ctx, curves)) {
-	failf(data, "failed setting curves list for QUIC: '%s'", curves);
-	return CURLE_SSL_CIPHER;
-	}
-	}
-
-	#ifndef OPENSSL_IS_BORINGSSL
-	{
-	const char *ciphers13 = conn_config->cipher_list13 ?
-	conn_config->cipher_list13 : QUIC_CIPHERS;
-	if(SSL_CTX_set_ciphersuites(ssl_ctx, ciphers13) != 1) {
-	failf(data, "failed setting QUIC cipher suite: %s", ciphers13);
-	return CURLE_SSL_CIPHER;
-	}
-	infof(data, "QUIC cipher selection: %s", ciphers13);
-	}
-	#endif
-
-	/* Open the file if a TLS or QUIC backend has not done this before. */
-	Curl_tls_keylog_open();
-	if(Curl_tls_keylog_enabled()) {
-	SSL_CTX_set_keylog_callback(ssl_ctx, keylog_callback);
-	}
-
-	/* OpenSSL always tries to verify the peer, this only says whether it should
-	* fail to connect if the verification fails, or if it should continue
-	* anyway. In the latter case the result of the verification is checked with
-	* SSL_get_verify_result() below. */
-	SSL_CTX_set_verify(ssl_ctx, conn_config->verifypeer ?
-	SSL_VERIFY_PEER : SSL_VERIFY_NONE, NULL);
-
-	/* give application a chance to interfere with SSL set up. */
-	if(data->set.ssl.fsslctx) {
-	/* When a user callback is installed to modify the SSL_CTX,
-	* we need to do the full initialization before calling it.
-	* See: #11800 */
-	if(!ctx->x509_store_setup) {
-	result = Curl_ssl_setup_x509_store(cf, data, ssl_ctx);
-	if(result)
-	goto out;
-	ctx->x509_store_setup = TRUE;
-	}
-	Curl_set_in_callback(data, true);
-	result = (*data->set.ssl.fsslctx)(data, ssl_ctx,
-	data->set.ssl.fsslctxp);
-	Curl_set_in_callback(data, false);
-	if(result) {
-	failf(data, "error signaled by ssl ctx callback");
-	goto out;
-	}
-	}
-	result = CURLE_OK;
-
-	out:
-	*pssl_ctx = result? NULL : ssl_ctx;
-	if(result && ssl_ctx)
-	SSL_CTX_free(ssl_ctx);
-	return result;
-	}
-
-	static CURLcode quic_set_client_cert(struct Curl_cfilter *cf,
-	struct Curl_easy *data)
-	{
-	struct cf_ngtcp2_ctx *ctx = cf->ctx;
-	SSL_CTX *ssl_ctx = ctx->sslctx;
-	const struct ssl_config_data *ssl_config;
-
-	ssl_config = Curl_ssl_cf_get_config(cf, data);
-	DEBUGASSERT(ssl_config);
-
-	if(ssl_config->primary.clientcert \|\| ssl_config->primary.cert_blob
-	\|\| ssl_config->cert_type) {
-	return Curl_ossl_set_client_cert(
-	data, ssl_ctx, ssl_config->primary.clientcert,
-	ssl_config->primary.cert_blob, ssl_config->cert_type,
-	ssl_config->key, ssl_config->key_blob,
-	ssl_config->key_type, ssl_config->key_passwd);
-	}
-
-	return CURLE_OK;
-	}
-
-	/ SSL callbacks */
-
-	static CURLcode quic_init_ssl(struct Curl_cfilter *cf,
-	struct Curl_easy *data)
-	{
-	struct cf_ngtcp2_ctx *ctx = cf->ctx;
-	const uint8_t *alpn = NULL;
-	size_t alpnlen = 0;
-
-	DEBUGASSERT(!ctx->ssl);
-	ctx->ssl = SSL_new(ctx->sslctx);
-
-	SSL_set_app_data(ctx->ssl, &ctx->conn_ref);
-	SSL_set_connect_state(ctx->ssl);
-	SSL_set_quic_use_legacy_codepoint(ctx->ssl, 0);
-
-	alpn = (const uint8_t *)H3_ALPN_H3 H3_ALPN_H3_29;
-	alpnlen = sizeof(H3_ALPN_H3) - 1 + sizeof(H3_ALPN_H3_29) - 1;
-	if(alpn)
-	SSL_set_alpn_protos(ctx->ssl, alpn, (int)alpnlen);
-
-	/* set SNI */
-	if(ctx->peer.sni) {
-	if(!SSL_set_tlsext_host_name(ctx->ssl, ctx->peer.sni)) {
-	failf(data, "Failed set SNI");
-	SSL_free(ctx->ssl);
-	ctx->ssl = NULL;
-	return CURLE_QUIC_CONNECT_ERROR;
-	}
-	}
-	return CURLE_OK;
-	}
-	#elif defined(USE_GNUTLS)
-	static CURLcode quic_init_ssl(struct Curl_cfilter *cf,
-	struct Curl_easy *data)
-	{
-	struct cf_ngtcp2_ctx *ctx = cf->ctx;
-	struct ssl_primary_config *conn_config;
-	CURLcode result;
-	gnutls_datum_t alpn[2];
-	/* this will need some attention when HTTPS proxy over QUIC get fixed */
-	long * const pverifyresult = &data->set.ssl.certverifyresult;
-	int rc;
-
-	conn_config = Curl_ssl_cf_get_primary_config(cf);
-	if(!conn_config)
-	return CURLE_FAILED_INIT;
-
-	DEBUGASSERT(ctx->gtls == NULL);
-	ctx->gtls = calloc(1, sizeof(*(ctx->gtls)));
-	if(!ctx->gtls)
-	return CURLE_OUT_OF_MEMORY;
-
-	result = gtls_client_init(data, conn_config, &data->set.ssl,
-	&ctx->peer, ctx->gtls, pverifyresult);
-	if(result)
-	return result;
-
-	gnutls_session_set_ptr(ctx->gtls->session, &ctx->conn_ref);
-
-	if(ngtcp2_crypto_gnutls_configure_client_session(ctx->gtls->session) != 0) {
-	CURL_TRC_CF(data, cf,
-	"ngtcp2_crypto_gnutls_configure_client_session failed\n");
-	return CURLE_QUIC_CONNECT_ERROR;
-	}
-
-	rc = gnutls_priority_set_direct(ctx->gtls->session, QUIC_PRIORITY, NULL);
-	if(rc < 0) {
-	CURL_TRC_CF(data, cf, "gnutls_priority_set_direct failed: %s\n",
-	gnutls_strerror(rc));
-	return CURLE_QUIC_CONNECT_ERROR;
-	}
-
-	/* Open the file if a TLS or QUIC backend has not done this before. */
-	Curl_tls_keylog_open();
-	if(Curl_tls_keylog_enabled()) {
-	gnutls_session_set_keylog_function(ctx->gtls->session, keylog_callback);
-	}
-
-	/* strip the first byte (the length) from NGHTTP3_ALPN_H3 */
-	alpn[0].data = (unsigned char *)H3_ALPN_H3 + 1;
-	alpn[0].size = sizeof(H3_ALPN_H3) - 2;
-	alpn[1].data = (unsigned char *)H3_ALPN_H3_29 + 1;
-	alpn[1].size = sizeof(H3_ALPN_H3_29) - 2;
-
-	gnutls_alpn_set_protocols(ctx->gtls->session,
-	alpn, 2, GNUTLS_ALPN_MANDATORY);
-	return CURLE_OK;
-	}
-	#elif defined(USE_WOLFSSL)
-
-	static CURLcode quic_ssl_ctx(WOLFSSL_CTX **pssl_ctx,
-	struct Curl_cfilter cf, struct Curl_easy data)
-	{
-	CURLcode result = CURLE_FAILED_INIT;
-	struct ssl_primary_config *conn_config;
-	WOLFSSL_CTX *ssl_ctx = NULL;
-
-	conn_config = Curl_ssl_cf_get_primary_config(cf);
-	if(!conn_config) {
-	result = CURLE_FAILED_INIT;
-	goto out;
-	}
-
-	ssl_ctx = wolfSSL_CTX_new(wolfTLSv1_3_client_method());
-	if(!ssl_ctx) {
-	result = CURLE_OUT_OF_MEMORY;
-	goto out;
-	}
-
-	if(ngtcp2_crypto_wolfssl_configure_client_context(ssl_ctx) != 0) {
-	failf(data, "ngtcp2_crypto_wolfssl_configure_client_context failed");
-	result = CURLE_FAILED_INIT;
-	goto out;
-	}
-
-	wolfSSL_CTX_set_default_verify_paths(ssl_ctx);
-
-	if(wolfSSL_CTX_set_cipher_list(ssl_ctx, conn_config->cipher_list13 ?
-	conn_config->cipher_list13 :
-	QUIC_CIPHERS) != 1) {
-	char error_buffer[256];
-	ERR_error_string_n(ERR_get_error(), error_buffer, sizeof(error_buffer));
-	failf(data, "wolfSSL failed to set ciphers: %s", error_buffer);
-	goto out;
-	}
-
-	if(wolfSSL_CTX_set1_groups_list(ssl_ctx, conn_config->curves ?
-	conn_config->curves :
-	(char *)QUIC_GROUPS) != 1) {
-	failf(data, "wolfSSL failed to set curves");
-	goto out;
-	}
-
-	/* Open the file if a TLS or QUIC backend has not done this before. */
-	Curl_tls_keylog_open();
-	if(Curl_tls_keylog_enabled()) {
-	#if defined(HAVE_SECRET_CALLBACK)
-	wolfSSL_CTX_set_keylog_callback(ssl_ctx, keylog_callback);
-	#else
-	failf(data, "wolfSSL was built without keylog callback");
-	goto out;
-	#endif
-	}
-
-	if(conn_config->verifypeer) {
-	const char * const ssl_cafile = conn_config->CAfile;
-	const char * const ssl_capath = conn_config->CApath;
-
-	wolfSSL_CTX_set_verify(ssl_ctx, SSL_VERIFY_PEER, NULL);
-	if(ssl_cafile \|\| ssl_capath) {
-	/* tell wolfSSL where to find CA certificates that are used to verify
-	the server's certificate. */
-	int rc =
-	wolfSSL_CTX_load_verify_locations_ex(ssl_ctx, ssl_cafile, ssl_capath,
-	WOLFSSL_LOAD_FLAG_IGNORE_ERR);
-	if(SSL_SUCCESS != rc) {
-	/* Fail if we insist on successfully verifying the server. */
-	failf(data, "error setting certificate verify locations:"
-	" CAfile: %s CApath: %s",
-	ssl_cafile ? ssl_cafile : "none",
-	ssl_capath ? ssl_capath : "none");
-	goto out;
-	}
-	infof(data, " CAfile: %s", ssl_cafile ? ssl_cafile : "none");
-	infof(data, " CApath: %s", ssl_capath ? ssl_capath : "none");
-	}
-	#ifdef CURL_CA_FALLBACK
-	else {
-	/* verifying the peer without any CA certificates won't work so
-	use wolfssl's built-in default as fallback */
-	wolfSSL_CTX_set_default_verify_paths(ssl_ctx);
-	}
-	#endif
-	}
-	else {
-	wolfSSL_CTX_set_verify(ssl_ctx, SSL_VERIFY_NONE, NULL);
-	}
-
-	/* give application a chance to interfere with SSL set up. */
-	if(data->set.ssl.fsslctx) {
-	Curl_set_in_callback(data, true);
-	result = (*data->set.ssl.fsslctx)(data, ssl_ctx,
-	data->set.ssl.fsslctxp);
-	Curl_set_in_callback(data, false);
-	if(result) {
-	failf(data, "error signaled by ssl ctx callback");
-	goto out;
-	}
-	}
-	result = CURLE_OK;
-
-	out:
-	*pssl_ctx = result? NULL : ssl_ctx;
-	if(result && ssl_ctx)
-	SSL_CTX_free(ssl_ctx);
-	return result;
-	}
-
-	/ SSL callbacks */
-
-	static CURLcode quic_init_ssl(struct Curl_cfilter *cf,
-	struct Curl_easy *data)
-	{
-	struct cf_ngtcp2_ctx *ctx = cf->ctx;
-	const uint8_t *alpn = NULL;
-	size_t alpnlen = 0;
-	/* this will need some attention when HTTPS proxy over QUIC get fixed */
-	const char * const hostname = cf->conn->host.name;
-
-	(void)data;
-	DEBUGASSERT(!ctx->ssl);
-	ctx->ssl = wolfSSL_new(ctx->sslctx);
-
-	wolfSSL_set_app_data(ctx->ssl, &ctx->conn_ref);
-	wolfSSL_set_connect_state(ctx->ssl);
-	wolfSSL_set_quic_use_legacy_codepoint(ctx->ssl, 0);
-
-	alpn = (const uint8_t *)H3_ALPN_H3 H3_ALPN_H3_29;
-	alpnlen = sizeof(H3_ALPN_H3) - 1 + sizeof(H3_ALPN_H3_29) - 1;
-	if(alpn)
-	wolfSSL_set_alpn_protos(ctx->ssl, alpn, (int)alpnlen);
-
-	/* set SNI */
-	wolfSSL_UseSNI(ctx->ssl, WOLFSSL_SNI_HOST_NAME,
-	hostname, (unsigned short)strlen(hostname));
-
-	return CURLE_OK;
-	}
-	#endif /* defined(USE_WOLFSSL) */
-
	static int cb_handshake_completed(ngtcp2_conn tconn, void user_data)
	{
	(void)user_data;
@@ -1950,49 +1535,12 @@ static CURLcode qng_verify_peer(struct Curl_cfilter *cf,
	struct Curl_easy *data)
	{
	struct cf_ngtcp2_ctx *ctx = cf->ctx;
-	struct ssl_primary_config *conn_config;
-	CURLcode result = CURLE_OK;
-
-	conn_config = Curl_ssl_cf_get_primary_config(cf);
-	if(!conn_config)
-	return CURLE_FAILED_INIT;

	cf->conn->bits.multiplex = TRUE; /* at least potentially multiplexed */
	cf->conn->httpversion = 30;
	cf->conn->bundle->multiuse = BUNDLE_MULTIPLEX;

-	if(conn_config->verifyhost) {
-	#ifdef USE_OPENSSL
-	X509 *server_cert;
-	server_cert = SSL_get1_peer_certificate(ctx->ssl);
-	if(!server_cert) {
-	return CURLE_PEER_FAILED_VERIFICATION;
-	}
-	result = Curl_ossl_verifyhost(data, cf->conn, &ctx->peer, server_cert);
-	X509_free(server_cert);
-	if(result)
-	return result;
-	#elif defined(USE_GNUTLS)
-	result = Curl_gtls_verifyserver(data, ctx->gtls->session,
-	conn_config, &data->set.ssl, &ctx->peer,
-	data->set.str[STRING_SSL_PINNEDPUBLICKEY]);
-	if(result)
-	return result;
-	#elif defined(USE_WOLFSSL)
-	if(!ctx->peer.sni \|\|
-	wolfSSL_check_domain_name(ctx->ssl, ctx->peer.sni) == SSL_FAILURE)
-	return CURLE_PEER_FAILED_VERIFICATION;
-	#endif
-	infof(data, "Verified certificate just fine");
-	}
-	else
-	infof(data, "Skipped certificate verification");
-	#ifdef USE_OPENSSL
-	if(data->set.ssl.certinfo)
-	/* asked to gather certificate info */
-	(void)Curl_ossl_certchain(data, ctx->ssl);
-	#endif
-	return result;
+	return Curl_vquic_tls_verify_peer(&ctx->tls, cf, data, &ctx->peer);
	}

	static CURLcode recv_pkt(const unsigned char *pkt, size_t pktlen,
@@ -2056,14 +1604,9 @@ static CURLcode cf_progress_ingress(struct Curl_cfilter *cf,
	pktx_update_time(pktx, cf);
	}

-	#ifdef USE_OPENSSL
-	if(!ctx->x509_store_setup) {
-	result = Curl_ssl_setup_x509_store(cf, data, ctx->sslctx);
-	if(result)
-	return result;
-	ctx->x509_store_setup = TRUE;
-	}
-	#endif
+	result = Curl_vquic_tls_before_recv(&ctx->tls, cf, data);
+	if(result)
+	return result;

	for(i = 0; i < pkts_max; i += pkts_chunk) {
	pktx->pkt_count = 0;
@@ -2388,25 +1931,7 @@ static void cf_ngtcp2_ctx_clear(struct cf_ngtcp2_ctx *ctx)
	if(ctx->qlogfd != -1) {
	close(ctx->qlogfd);
	}
-	#ifdef USE_OPENSSL
-	if(ctx->ssl)
-	SSL_free(ctx->ssl);
-	if(ctx->sslctx)
-	SSL_CTX_free(ctx->sslctx);
-	#elif defined(USE_GNUTLS)
-	if(ctx->gtls) {
-	if(ctx->gtls->cred)
-	gnutls_certificate_free_credentials(ctx->gtls->cred);
-	if(ctx->gtls->session)
-	gnutls_deinit(ctx->gtls->session);
-	free(ctx->gtls);
-	}
-	#elif defined(USE_WOLFSSL)
-	if(ctx->ssl)
-	wolfSSL_free(ctx->ssl);
-	if(ctx->sslctx)
-	wolfSSL_CTX_free(ctx->sslctx);
-	#endif
+	Curl_vquic_tls_cleanup(&ctx->tls);
	vquic_ctx_free(&ctx->q);
	if(ctx->h3conn)
	nghttp3_conn_del(ctx->h3conn);
@@ -2465,6 +1990,37 @@ static void cf_ngtcp2_destroy(struct Curl_cfilter cf, struct Curl_easy data)
	(void)save;
	}

+	static CURLcode tls_ctx_setup(struct quic_tls_ctx *ctx,
+	struct Curl_cfilter *cf,
+	struct Curl_easy *data)
+	{
+	(void)cf;
+	#ifdef USE_OPENSSL
+	#if defined(OPENSSL_IS_BORINGSSL) \|\| defined(OPENSSL_IS_AWSLC)
+	if(ngtcp2_crypto_boringssl_configure_client_context(ctx->ssl_ctx) != 0) {
+	failf(data, "ngtcp2_crypto_boringssl_configure_client_context failed");
+	return CURLE_FAILED_INIT;
+	}
+	#else
+	if(ngtcp2_crypto_quictls_configure_client_context(ctx->ssl_ctx) != 0) {
+	failf(data, "ngtcp2_crypto_quictls_configure_client_context failed");
+	return CURLE_FAILED_INIT;
+	}
+	#endif /* !OPENSSL_IS_BORINGSSL && !OPENSSL_IS_AWSLC */
+	#elif defined(USE_GNUTLS)
+	if(ngtcp2_crypto_gnutls_configure_client_session(ctx->gtls->session) != 0) {
+	failf(data, "ngtcp2_crypto_gnutls_configure_client_session failed");
+	return CURLE_FAILED_INIT;
+	}
+	#elif defined(USE_WOLFSSL)
+	if(ngtcp2_crypto_wolfssl_configure_client_context(ctx->ssl_ctx) != 0) {
+	failf(data, "ngtcp2_crypto_wolfssl_configure_client_context failed");
+	return CURLE_FAILED_INIT;
+	}
+	#endif
+	return CURLE_OK;
+	}
+
	/*
	* Might be called twice for happy eyeballs.
	*/
@@ -2489,21 +2045,10 @@ static CURLcode cf_connect_start(struct Curl_cfilter *cf,
	if(result)
	return result;

-	#ifdef USE_OPENSSL
-	result = quic_ssl_ctx(&ctx->sslctx, cf, data);
-	if(result)
-	return result;
-
-	result = quic_set_client_cert(cf, data);
-	if(result)
-	return result;
-	#elif defined(USE_WOLFSSL)
-	result = quic_ssl_ctx(&ctx->sslctx, cf, data);
-	if(result)
-	return result;
-	#endif
-
-	result = quic_init_ssl(cf, data);
+	#define H3_ALPN "\x2h3\x5h3-29"
+	result = Curl_vquic_tls_init(&ctx->tls, cf, data, &ctx->peer,
+	H3_ALPN, sizeof(H3_ALPN) - 1,
+	tls_ctx_setup, &ctx->conn_ref);
	if(result)
	return result;

@@ -2550,9 +2095,9 @@ static CURLcode cf_connect_start(struct Curl_cfilter *cf,
	return CURLE_QUIC_CONNECT_ERROR;

	#ifdef USE_GNUTLS
-	ngtcp2_conn_set_tls_native_handle(ctx->qconn, ctx->gtls->session);
+	ngtcp2_conn_set_tls_native_handle(ctx->qconn, ctx->tls.gtls->session);
	#else
-	ngtcp2_conn_set_tls_native_handle(ctx->qconn, ctx->ssl);
+	ngtcp2_conn_set_tls_native_handle(ctx->qconn, ctx->tls.ssl);
	#endif

	ngtcp2_ccerr_default(&ctx->last_error);
@@ -2683,8 +2228,8 @@ static CURLcode cf_ngtcp2_query(struct Curl_cfilter *cf,
	return CURLE_OK;
	}
	case CF_QUERY_CONNECT_REPLY_MS:
-	if(ctx->got_first_byte) {
-	timediff_t ms = Curl_timediff(ctx->first_byte_at, ctx->started_at);
+	if(ctx->q.got_first_byte) {
+	timediff_t ms = Curl_timediff(ctx->q.first_byte_at, ctx->started_at);
	*pres1 = (ms < INT_MAX)? (int)ms : INT_MAX;
	}
	else
@@ -2692,8 +2237,8 @@ static CURLcode cf_ngtcp2_query(struct Curl_cfilter *cf,
	return CURLE_OK;
	case CF_QUERY_TIMER_CONNECT: {
	struct curltime *when = pres2;
-	if(ctx->got_first_byte)
-	*when = ctx->first_byte_at;
+	if(ctx->q.got_first_byte)
+	*when = ctx->q.first_byte_at;
	return CURLE_OK;
	}
	case CF_QUERY_TIMER_APPCONNECT: {

lib/vquic/curl_quiche.c+51 -186

@@ -43,6 +43,7 @@
	#include "http1.h"
	#include "vquic.h"
	#include "vquic_int.h"
+	#include "vquic-tls.h"
	#include "curl_quiche.h"
	#include "transfer.h"
	#include "inet_pton.h"
@@ -84,31 +85,22 @@ void Curl_quiche_ver(char *p, size_t len)
	(void)msnprintf(p, len, "quiche/%s", quiche_version());
	}

-	static void keylog_callback(const SSL ssl, const char line)
-	{
-	(void)ssl;
-	Curl_tls_keylog_write_line(line);
-	}
-
	struct cf_quiche_ctx {
	struct cf_quic_ctx q;
	struct ssl_peer peer;
+	struct quic_tls_ctx tls;
	quiche_conn *qconn;
	quiche_config *cfg;
	quiche_h3_conn *h3c;
	quiche_h3_config *h3config;
	uint8_t scid[QUICHE_MAX_CONN_ID_LEN];
-	SSL_CTX *sslctx;
-	SSL *ssl;
	struct curltime started_at; /* time the current attempt started */
	struct curltime handshake_at; /* time connect handshake finished */
-	struct curltime first_byte_at; /* when first byte was recvd */
	struct curltime reconnect_at; /* time the next attempt should start */
	struct bufc_pool stream_bufcp; /* chunk pool for streams */
	curl_off_t data_recvd;
	uint64_t max_idle_ms; /* max idle time for QUIC conn */
	BIT(goaway); /* got GOAWAY from server */
-	BIT(got_first_byte); /* if first byte was received */
	BIT(x509_store_setup); /* if x509 store has been set up */
	};

@@ -123,121 +115,25 @@ static void quiche_debug_log(const char line, void argp)
	static void cf_quiche_ctx_clear(struct cf_quiche_ctx *ctx)
	{
	if(ctx) {
-	vquic_ctx_free(&ctx->q);
-	if(ctx->qconn)
-	quiche_conn_free(ctx->qconn);
-	if(ctx->h3config)
-	quiche_h3_config_free(ctx->h3config);
	if(ctx->h3c)
	quiche_h3_conn_free(ctx->h3c);
+	if(ctx->h3config)
+	quiche_h3_config_free(ctx->h3config);
+	if(ctx->qconn)
+	quiche_conn_free(ctx->qconn);
	if(ctx->cfg)
	quiche_config_free(ctx->cfg);
-	Curl_bufcp_free(&ctx->stream_bufcp);
+	/* quiche just freed ctx->tls.ssl */
+	ctx->tls.ssl = NULL;
+	Curl_vquic_tls_cleanup(&ctx->tls);
	Curl_ssl_peer_cleanup(&ctx->peer);
+	vquic_ctx_free(&ctx->q);
+	Curl_bufcp_free(&ctx->stream_bufcp);

	memset(ctx, 0, sizeof(*ctx));
	}
	}

-	static CURLcode quic_x509_store_setup(struct Curl_cfilter *cf,
-	struct Curl_easy *data)
-	{
-	struct cf_quiche_ctx *ctx = cf->ctx;
-	struct ssl_primary_config *conn_config;
-
-	conn_config = Curl_ssl_cf_get_primary_config(cf);
-	if(!conn_config)
-	return CURLE_FAILED_INIT;
-
-	if(!ctx->x509_store_setup) {
-	if(conn_config->verifypeer) {
-	const char * const ssl_cafile = conn_config->CAfile;
-	const char * const ssl_capath = conn_config->CApath;
-	if(ssl_cafile \|\| ssl_capath) {
-	SSL_CTX_set_verify(ctx->sslctx, SSL_VERIFY_PEER, NULL);
-	/* tell OpenSSL where to find CA certificates that are used to verify
-	the server's certificate. */
-	if(!SSL_CTX_load_verify_locations(ctx->sslctx, ssl_cafile,
-	ssl_capath)) {
-	/* Fail if we insist on successfully verifying the server. */
-	failf(data, "error setting certificate verify locations:"
-	" CAfile: %s CApath: %s",
-	ssl_cafile ? ssl_cafile : "none",
-	ssl_capath ? ssl_capath : "none");
-	return CURLE_SSL_CACERT_BADFILE;
-	}
-	infof(data, " CAfile: %s", ssl_cafile ? ssl_cafile : "none");
-	infof(data, " CApath: %s", ssl_capath ? ssl_capath : "none");
-	}
-	#ifdef CURL_CA_FALLBACK
-	else {
-	/* verifying the peer without any CA certificates won't work so
-	use openssl's built-in default as fallback */
-	SSL_CTX_set_default_verify_paths(ctx->sslctx);
-	}
-	#endif
-	}
-	ctx->x509_store_setup = TRUE;
-	}
-	return CURLE_OK;
-	}
-
-	static CURLcode quic_ssl_setup(struct Curl_cfilter cf, struct Curl_easy data)
-	{
-	struct cf_quiche_ctx *ctx = cf->ctx;
-	struct ssl_primary_config *conn_config;
-	CURLcode result;
-
-	conn_config = Curl_ssl_cf_get_primary_config(cf);
-	if(!conn_config)
-	return CURLE_FAILED_INIT;
-
-	result = Curl_ssl_peer_init(&ctx->peer, cf);
-	if(result)
-	return result;
-
-	DEBUGASSERT(!ctx->sslctx);
-	ctx->sslctx = SSL_CTX_new(TLS_method());
-	if(!ctx->sslctx)
-	return CURLE_OUT_OF_MEMORY;
-
-	SSL_CTX_set_alpn_protos(ctx->sslctx,
-	(const uint8_t *)QUICHE_H3_APPLICATION_PROTOCOL,
-	sizeof(QUICHE_H3_APPLICATION_PROTOCOL) - 1);
-
-	SSL_CTX_set_default_verify_paths(ctx->sslctx);
-
-	/* Open the file if a TLS or QUIC backend has not done this before. */
-	Curl_tls_keylog_open();
-	if(Curl_tls_keylog_enabled()) {
-	SSL_CTX_set_keylog_callback(ctx->sslctx, keylog_callback);
-	}
-
-	if(conn_config->curves &&
-	!SSL_CTX_set1_curves_list(ctx->sslctx, conn_config->curves)) {
-	failf(data, "failed setting curves list for QUIC: '%s'",
-	conn_config->curves);
-	return CURLE_SSL_CIPHER;
-	}
-
-	ctx->ssl = SSL_new(ctx->sslctx);
-	if(!ctx->ssl)
-	return CURLE_QUIC_CONNECT_ERROR;
-
-	SSL_set_app_data(ctx->ssl, cf);
-
-	if(ctx->peer.sni) {
-	if(!SSL_set_tlsext_host_name(ctx->ssl, ctx->peer.sni)) {
-	failf(data, "Failed set SNI");
-	SSL_free(ctx->ssl);
-	ctx->ssl = NULL;
-	return CURLE_QUIC_CONNECT_ERROR;
-	}
-	}
-
-	return CURLE_OK;
-	}
-
	/**
	* All about the H3 internals of a stream
	*/
@@ -668,7 +564,7 @@ static CURLcode recv_pkt(const unsigned char *pkt, size_t pktlen,
	return CURLE_OK;
	}
	else if(QUICHE_ERR_TLS_FAIL == nread) {
-	long verify_ok = SSL_get_verify_result(ctx->ssl);
+	long verify_ok = SSL_get_verify_result(ctx->tls.ssl);
	if(verify_ok != X509_V_OK) {
	failf(r->data, "SSL certificate problem: %s",
	X509_verify_cert_error_string(verify_ok));
@@ -696,7 +592,7 @@ static CURLcode cf_process_ingress(struct Curl_cfilter *cf,
	CURLcode result;

	DEBUGASSERT(ctx->qconn);
-	result = quic_x509_store_setup(cf, data);
+	result = Curl_vquic_tls_before_recv(&ctx->tls, cf, data);
	if(result)
	return result;

@@ -1277,66 +1173,6 @@ static CURLcode cf_quiche_data_event(struct Curl_cfilter *cf,
	return result;
	}

-	static CURLcode cf_verify_peer(struct Curl_cfilter *cf,
-	struct Curl_easy *data)
-	{
-	struct cf_quiche_ctx *ctx = cf->ctx;
-	struct ssl_primary_config *conn_config;
-	CURLcode result = CURLE_OK;
-
-	conn_config = Curl_ssl_cf_get_primary_config(cf);
-	if(!conn_config)
-	return CURLE_FAILED_INIT;
-
-	cf->conn->bits.multiplex = TRUE; /* at least potentially multiplexed */
-	cf->conn->httpversion = 30;
-	cf->conn->bundle->multiuse = BUNDLE_MULTIPLEX;
-
-	if(conn_config->verifyhost) {
-	X509 *server_cert;
-	server_cert = SSL_get_peer_certificate(ctx->ssl);
-	if(!server_cert) {
-	result = CURLE_PEER_FAILED_VERIFICATION;
-	goto out;
-	}
-	result = Curl_ossl_verifyhost(data, cf->conn, &ctx->peer, server_cert);
-	X509_free(server_cert);
-	if(result)
-	goto out;
-	}
-	else
-	CURL_TRC_CF(data, cf, "Skipped certificate verification");
-
-	ctx->h3config = quiche_h3_config_new();
-	if(!ctx->h3config) {
-	result = CURLE_OUT_OF_MEMORY;
-	goto out;
-	}
-
-	/* Create a new HTTP/3 connection on the QUIC connection. */
-	ctx->h3c = quiche_h3_conn_new_with_transport(ctx->qconn, ctx->h3config);
-	if(!ctx->h3c) {
-	result = CURLE_OUT_OF_MEMORY;
-	goto out;
-	}
-	if(data->set.ssl.certinfo)
-	/* asked to gather certificate info */
-	(void)Curl_ossl_certchain(data, ctx->ssl);
-
-	out:
-	if(result) {
-	if(ctx->h3config) {
-	quiche_h3_config_free(ctx->h3config);
-	ctx->h3config = NULL;
-	}
-	if(ctx->h3c) {
-	quiche_h3_conn_free(ctx->h3c);
-	ctx->h3c = NULL;
-	}
-	}
-	return result;
-	}
-
	static CURLcode cf_connect_start(struct Curl_cfilter *cf,
	struct Curl_easy *data)
	{
@@ -1364,6 +1200,10 @@ static CURLcode cf_connect_start(struct Curl_cfilter *cf,
	if(result)
	return result;

+	result = Curl_ssl_peer_init(&ctx->peer, cf);
+	if(result)
+	return result;
+
	ctx->cfg = quiche_config_new(QUICHE_PROTOCOL_VERSION);
	if(!ctx->cfg) {
	failf(data, "can't create quiche config");
@@ -1392,9 +1232,10 @@ static CURLcode cf_connect_start(struct Curl_cfilter *cf,
	sizeof(QUICHE_H3_APPLICATION_PROTOCOL)
	- 1);

-	DEBUGASSERT(!ctx->ssl);
-	DEBUGASSERT(!ctx->sslctx);
-	result = quic_ssl_setup(cf, data);
+	result = Curl_vquic_tls_init(&ctx->tls, cf, data, &ctx->peer,
+	QUICHE_H3_APPLICATION_PROTOCOL,
+	sizeof(QUICHE_H3_APPLICATION_PROTOCOL) - 1,
+	NULL, cf);
	if(result)
	return result;

@@ -1415,7 +1256,7 @@ static CURLcode cf_connect_start(struct Curl_cfilter *cf,
	(struct sockaddr *)&ctx->q.local_addr,
	ctx->q.local_addrlen,
	&sockaddr->sa_addr, sockaddr->addrlen,
-	ctx->cfg, ctx->ssl, false);
+	ctx->cfg, ctx->tls.ssl, false);
	if(!ctx->qconn) {
	failf(data, "can't create quiche connection");
	return CURLE_OUT_OF_MEMORY;
@@ -1454,6 +1295,18 @@ static CURLcode cf_connect_start(struct Curl_cfilter *cf,
	return CURLE_OK;
	}

+	static CURLcode cf_quiche_verify_peer(struct Curl_cfilter *cf,
+	struct Curl_easy *data)
+	{
+	struct cf_quiche_ctx *ctx = cf->ctx;
+
+	cf->conn->bits.multiplex = TRUE; /* at least potentially multiplexed */
+	cf->conn->httpversion = 30;
+	cf->conn->bundle->multiuse = BUNDLE_MULTIPLEX;
+
+	return Curl_vquic_tls_verify_peer(&ctx->tls, cf, data, &ctx->peer);
+	}
+
	static CURLcode cf_quiche_connect(struct Curl_cfilter *cf,
	struct Curl_easy *data,
	bool blocking, bool *done)
@@ -1505,9 +1358,21 @@ static CURLcode cf_quiche_connect(struct Curl_cfilter *cf,
	ctx->handshake_at = ctx->q.last_op;
	CURL_TRC_CF(data, cf, "handshake complete after %dms",
	(int)Curl_timediff(ctx->handshake_at, ctx->started_at));
-	result = cf_verify_peer(cf, data);
+	result = cf_quiche_verify_peer(cf, data);
	if(!result) {
	CURL_TRC_CF(data, cf, "peer verified");
+	ctx->h3config = quiche_h3_config_new();
+	if(!ctx->h3config) {
+	result = CURLE_OUT_OF_MEMORY;
+	goto out;
+	}
+
+	/* Create a new HTTP/3 connection on the QUIC connection. */
+	ctx->h3c = quiche_h3_conn_new_with_transport(ctx->qconn, ctx->h3config);
+	if(!ctx->h3c) {
+	result = CURLE_OUT_OF_MEMORY;
+	goto out;
+	}
	cf->connected = TRUE;
	cf->conn->alpn = CURL_HTTP_VERSION_3;
	*done = TRUE;
@@ -1580,8 +1445,8 @@ static CURLcode cf_quiche_query(struct Curl_cfilter *cf,
	return CURLE_OK;
	}
	case CF_QUERY_CONNECT_REPLY_MS:
-	if(ctx->got_first_byte) {
-	timediff_t ms = Curl_timediff(ctx->first_byte_at, ctx->started_at);
+	if(ctx->q.got_first_byte) {
+	timediff_t ms = Curl_timediff(ctx->q.first_byte_at, ctx->started_at);
	*pres1 = (ms < INT_MAX)? (int)ms : INT_MAX;
	}
	else
@@ -1589,8 +1454,8 @@ static CURLcode cf_quiche_query(struct Curl_cfilter *cf,
	return CURLE_OK;
	case CF_QUERY_TIMER_CONNECT: {
	struct curltime *when = pres2;
-	if(ctx->got_first_byte)
-	*when = ctx->first_byte_at;
+	if(ctx->q.got_first_byte)
+	*when = ctx->q.first_byte_at;
	return CURLE_OK;
	}
	case CF_QUERY_TIMER_APPCONNECT: {

lib/vquic/vquic-tls.c+603 -0

@@ -0,0 +1,603 @@
+	/***************************************************************************
+	* _ _ ____ _
+	* Project ___\| \| \| \| _ \\| \|
+	* / __\| \| \| \| \|_) \| \|
+	* \| (__\| \|_\| \| _ <\| \|___
+	* \___\|\___/\|_\| \_\_____\|
+	*
+	* Copyright (C) Daniel Stenberg, <[email protected]>, et al.
+	*
+	* This software is licensed as described in the file COPYING, which
+	* you should have received as part of this distribution. The terms
+	* are also available at https://curl.se/docs/copyright.html.
+	*
+	* You may opt to use, copy, modify, merge, publish, distribute and/or sell
+	* copies of the Software, and permit persons to whom the Software is
+	* furnished to do so, under the terms of the COPYING file.
+	*
+	* This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+	* KIND, either express or implied.
+	*
+	* SPDX-License-Identifier: curl
+	*
+	***************************************************************************/
+
+	#include "curl_setup.h"
+
+	#if defined(ENABLE_QUIC) && \
+	(defined(USE_OPENSSL) \|\| defined(USE_GNUTLS) \|\| defined(USE_WOLFSSL))
+
+	#ifdef USE_OPENSSL
+	#include <openssl/err.h>
+	#include "vtls/openssl.h"
+	#elif defined(USE_GNUTLS)
+	#include <gnutls/abstract.h>
+	#include <gnutls/gnutls.h>
+	#include <gnutls/x509.h>
+	#include <gnutls/crypto.h>
+	#include <nettle/sha2.h>
+	#include "vtls/gtls.h"
+	#elif defined(USE_WOLFSSL)
+	#include <wolfssl/options.h>
+	#include <wolfssl/ssl.h>
+	#include <wolfssl/quic.h>
+	#include "vtls/wolfssl.h"
+	#endif
+
+	#include "urldata.h"
+	#include "curl_trc.h"
+	#include "cfilters.h"
+	#include "multiif.h"
+	#include "vtls/keylog.h"
+	#include "vtls/vtls.h"
+	#include "vquic-tls.h"
+
+	/* The last 3 #include files should be in this order */
+	#include "curl_printf.h"
+	#include "curl_memory.h"
+	#include "memdebug.h"
+
+	#ifndef ARRAYSIZE
+	#define ARRAYSIZE(A) (sizeof(A)/sizeof((A)[0]))
+	#endif
+
+	#ifdef USE_OPENSSL
+	#define QUIC_CIPHERS \
+	"TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_" \
+	"POLY1305_SHA256:TLS_AES_128_CCM_SHA256"
+	#define QUIC_GROUPS "P-256:X25519:P-384:P-521"
+	#elif defined(USE_GNUTLS)
+	#define QUIC_PRIORITY \
+	"NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-128-GCM:+AES-256-GCM:" \
+	"+CHACHA20-POLY1305:+AES-128-CCM:-GROUP-ALL:+GROUP-SECP256R1:" \
+	"+GROUP-X25519:+GROUP-SECP384R1:+GROUP-SECP521R1:" \
+	"%DISABLE_TLS13_COMPAT_MODE"
+	#elif defined(USE_WOLFSSL)
+	#define QUIC_CIPHERS \
+	"TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_" \
+	"POLY1305_SHA256:TLS_AES_128_CCM_SHA256"
+	#define QUIC_GROUPS "P-256:P-384:P-521"
+	#endif
+
+
+	#ifdef USE_OPENSSL
+
+	static void keylog_callback(const SSL ssl, const char line)
+	{
+	(void)ssl;
+	Curl_tls_keylog_write_line(line);
+	}
+
+	static CURLcode curl_ossl_init_ctx(struct quic_tls_ctx *ctx,
+	struct Curl_cfilter *cf,
+	struct Curl_easy *data,
+	Curl_vquic_tls_ctx_setup *ctx_setup)
+	{
+	struct ssl_primary_config *conn_config;
+	CURLcode result = CURLE_FAILED_INIT;
+
+	DEBUGASSERT(!ctx->ssl_ctx);
+	ctx->ssl_ctx = SSL_CTX_new(TLS_method());
+	if(!ctx->ssl_ctx) {
+	result = CURLE_OUT_OF_MEMORY;
+	goto out;
+	}
+	conn_config = Curl_ssl_cf_get_primary_config(cf);
+	if(!conn_config) {
+	result = CURLE_FAILED_INIT;
+	goto out;
+	}
+
+	if(ctx_setup) {
+	result = ctx_setup(ctx, cf, data);
+	if(result)
+	goto out;
+	}
+
+	SSL_CTX_set_default_verify_paths(ctx->ssl_ctx);
+
+	{
+	const char *curves = conn_config->curves ?
+	conn_config->curves : QUIC_GROUPS;
+	if(!SSL_CTX_set1_curves_list(ctx->ssl_ctx, curves)) {
+	failf(data, "failed setting curves list for QUIC: '%s'", curves);
+	return CURLE_SSL_CIPHER;
+	}
+	}
+
+	#ifndef OPENSSL_IS_BORINGSSL
+	{
+	const char *ciphers13 = conn_config->cipher_list13 ?
+	conn_config->cipher_list13 : QUIC_CIPHERS;
+	if(SSL_CTX_set_ciphersuites(ctx->ssl_ctx, ciphers13) != 1) {
+	failf(data, "failed setting QUIC cipher suite: %s", ciphers13);
+	return CURLE_SSL_CIPHER;
+	}
+	infof(data, "QUIC cipher selection: %s", ciphers13);
+	}
+	#endif
+
+	/* Open the file if a TLS or QUIC backend has not done this before. */
+	Curl_tls_keylog_open();
+	if(Curl_tls_keylog_enabled()) {
+	SSL_CTX_set_keylog_callback(ctx->ssl_ctx, keylog_callback);
+	}
+
+	/* OpenSSL always tries to verify the peer, this only says whether it should
+	* fail to connect if the verification fails, or if it should continue
+	* anyway. In the latter case the result of the verification is checked with
+	* SSL_get_verify_result() below. */
+	SSL_CTX_set_verify(ctx->ssl_ctx, conn_config->verifypeer ?
+	SSL_VERIFY_PEER : SSL_VERIFY_NONE, NULL);
+
+	/* give application a chance to interfere with SSL set up. */
+	if(data->set.ssl.fsslctx) {
+	/* When a user callback is installed to modify the SSL_CTX,
+	* we need to do the full initialization before calling it.
+	* See: #11800 */
+	if(!ctx->x509_store_setup) {
+	result = Curl_ssl_setup_x509_store(cf, data, ctx->ssl_ctx);
+	if(result)
+	goto out;
+	ctx->x509_store_setup = TRUE;
+	}
+	Curl_set_in_callback(data, true);
+	result = (*data->set.ssl.fsslctx)(data, ctx->ssl_ctx,
+	data->set.ssl.fsslctxp);
+	Curl_set_in_callback(data, false);
+	if(result) {
+	failf(data, "error signaled by ssl ctx callback");
+	goto out;
+	}
+	}
+	result = CURLE_OK;
+
+	out:
+	if(result && ctx->ssl_ctx) {
+	SSL_CTX_free(ctx->ssl_ctx);
+	ctx->ssl_ctx = NULL;
+	}
+	return result;
+	}
+
+	static CURLcode curl_ossl_set_client_cert(struct quic_tls_ctx *ctx,
+	struct Curl_cfilter *cf,
+	struct Curl_easy *data)
+	{
+	SSL_CTX *ssl_ctx = ctx->ssl_ctx;
+	const struct ssl_config_data *ssl_config;
+
+	ssl_config = Curl_ssl_cf_get_config(cf, data);
+	DEBUGASSERT(ssl_config);
+
+	if(ssl_config->primary.clientcert \|\|
+	ssl_config->primary.cert_blob \|\|
+	ssl_config->cert_type) {
+	return Curl_ossl_set_client_cert(
+	data, ssl_ctx, ssl_config->primary.clientcert,
+	ssl_config->primary.cert_blob, ssl_config->cert_type,
+	ssl_config->key, ssl_config->key_blob,
+	ssl_config->key_type, ssl_config->key_passwd);
+	}
+
+	return CURLE_OK;
+	}
+
+	/ SSL callbacks */
+
+	static CURLcode curl_ossl_init_ssl(struct quic_tls_ctx *ctx,
+	struct Curl_easy *data,
+	struct ssl_peer *peer,
+	const char *alpn, size_t alpn_len,
+	void *user_data)
+	{
+	DEBUGASSERT(!ctx->ssl);
+	ctx->ssl = SSL_new(ctx->ssl_ctx);
+
+	SSL_set_app_data(ctx->ssl, user_data);
+	SSL_set_connect_state(ctx->ssl);
+	SSL_set_quic_use_legacy_codepoint(ctx->ssl, 0);
+
+	if(alpn)
+	SSL_set_alpn_protos(ctx->ssl, (const uint8_t *)alpn, (int)alpn_len);
+
+	if(peer->sni) {
+	if(!SSL_set_tlsext_host_name(ctx->ssl, peer->sni)) {
+	failf(data, "Failed set SNI");
+	SSL_free(ctx->ssl);
+	ctx->ssl = NULL;
+	return CURLE_QUIC_CONNECT_ERROR;
+	}
+	}
+	return CURLE_OK;
+	}
+
+	#elif defined(USE_GNUTLS)
+	static int keylog_callback(gnutls_session_t session, const char *label,
+	const gnutls_datum_t *secret)
+	{
+	gnutls_datum_t crandom;
+	gnutls_datum_t srandom;
+
+	gnutls_session_get_random(session, &crandom, &srandom);
+	if(crandom.size != 32) {
+	return -1;
+	}
+
+	Curl_tls_keylog_write(label, crandom.data, secret->data, secret->size);
+	return 0;
+	}
+
+	static CURLcode curl_gtls_init_ctx(struct quic_tls_ctx *ctx,
+	struct Curl_cfilter *cf,
+	struct Curl_easy *data,
+	struct ssl_peer *peer,
+	const char *alpn, size_t alpn_len,
+	Curl_vquic_tls_ctx_setup *ctx_setup,
+	void *user_data)
+	{
+	struct ssl_primary_config *conn_config;
+	CURLcode result;
+	gnutls_datum_t alpns[5];
+	/* this will need some attention when HTTPS proxy over QUIC get fixed */
+	long * const pverifyresult = &data->set.ssl.certverifyresult;
+	int rc;
+
+	conn_config = Curl_ssl_cf_get_primary_config(cf);
+	if(!conn_config)
+	return CURLE_FAILED_INIT;
+
+	DEBUGASSERT(ctx->gtls == NULL);
+	ctx->gtls = calloc(1, sizeof(*(ctx->gtls)));
+	if(!ctx->gtls)
+	return CURLE_OUT_OF_MEMORY;
+
+	result = gtls_client_init(data, conn_config, &data->set.ssl,
+	peer, ctx->gtls, pverifyresult);
+	if(result)
+	return result;
+
+	gnutls_session_set_ptr(ctx->gtls->session, user_data);
+
+	if(ctx_setup) {
+	result = ctx_setup(ctx, cf, data);
+	if(result)
+	return result;
+	}
+
+	rc = gnutls_priority_set_direct(ctx->gtls->session, QUIC_PRIORITY, NULL);
+	if(rc < 0) {
+	CURL_TRC_CF(data, cf, "gnutls_priority_set_direct failed: %s\n",
+	gnutls_strerror(rc));
+	return CURLE_QUIC_CONNECT_ERROR;
+	}
+
+	/* Open the file if a TLS or QUIC backend has not done this before. */
+	Curl_tls_keylog_open();
+	if(Curl_tls_keylog_enabled()) {
+	gnutls_session_set_keylog_function(ctx->gtls->session, keylog_callback);
+	}
+
+	/* convert the ALPN string from our arguments to a list of strings
+	* that gnutls wants and will convert internally back to this very
+	* string for sending to the server. nice. */
+	if(alpn) {
+	size_t i, alen = alpn_len;
+	unsigned char s = (unsigned char )alpn;
+	unsigned char slen;
+	for(i = 0; (i < ARRAYSIZE(alpns)) && alen; ++i) {
+	slen = s[0];
+	if(slen >= alen)
+	return CURLE_FAILED_INIT;
+	alpns[i].data = s + 1;
+	alpns[i].size = slen;
+	s += slen + 1;
+	alen -= (size_t)slen + 1;
+	}
+	if(alen) /* not all alpn chars used, wrong format or too many */
+	return CURLE_FAILED_INIT;
+	if(i) {
+	gnutls_alpn_set_protocols(ctx->gtls->session,
+	alpns, (unsigned int)i,
+	GNUTLS_ALPN_MANDATORY);
+	}
+	}
+
+	return CURLE_OK;
+	}
+	#elif defined(USE_WOLFSSL)
+
+	#if defined(HAVE_SECRET_CALLBACK)
+	static void keylog_callback(const WOLFSSL ssl, const char line)
+	{
+	(void)ssl;
+	Curl_tls_keylog_write_line(line);
+	}
+	#endif
+
+	static CURLcode curl_wssl_init_ctx(struct quic_tls_ctx *ctx,
+	struct Curl_cfilter *cf,
+	struct Curl_easy *data,
+	Curl_vquic_tls_ctx_setup *ctx_setup)
+	{
+	struct ssl_primary_config *conn_config;
+	CURLcode result = CURLE_FAILED_INIT;
+
+	conn_config = Curl_ssl_cf_get_primary_config(cf);
+	if(!conn_config) {
+	result = CURLE_FAILED_INIT;
+	goto out;
+	}
+
+	ctx->ssl_ctx = wolfSSL_CTX_new(wolfTLSv1_3_client_method());
+	if(!ctx->ssl_ctx) {
+	result = CURLE_OUT_OF_MEMORY;
+	goto out;
+	}
+
+	if(ctx_setup) {
+	result = ctx_setup(ctx, cf, data);
+	if(result)
+	goto out;
+	}
+
+	wolfSSL_CTX_set_default_verify_paths(ctx->ssl_ctx);
+
+	if(wolfSSL_CTX_set_cipher_list(ctx->ssl_ctx, conn_config->cipher_list13 ?
+	conn_config->cipher_list13 :
+	QUIC_CIPHERS) != 1) {
+	char error_buffer[256];
+	ERR_error_string_n(ERR_get_error(), error_buffer, sizeof(error_buffer));
+	failf(data, "wolfSSL failed to set ciphers: %s", error_buffer);
+	goto out;
+	}
+
+	if(wolfSSL_CTX_set1_groups_list(ctx->ssl_ctx, conn_config->curves ?
+	conn_config->curves :
+	(char *)QUIC_GROUPS) != 1) {
+	failf(data, "wolfSSL failed to set curves");
+	goto out;
+	}
+
+	/* Open the file if a TLS or QUIC backend has not done this before. */
+	Curl_tls_keylog_open();
+	if(Curl_tls_keylog_enabled()) {
+	#if defined(HAVE_SECRET_CALLBACK)
+	wolfSSL_CTX_set_keylog_callback(ctx->ssl_ctx, keylog_callback);
+	#else
+	failf(data, "wolfSSL was built without keylog callback");
+	goto out;
+	#endif
+	}
+
+	if(conn_config->verifypeer) {
+	const char * const ssl_cafile = conn_config->CAfile;
+	const char * const ssl_capath = conn_config->CApath;
+
+	wolfSSL_CTX_set_verify(ctx->ssl_ctx, SSL_VERIFY_PEER, NULL);
+	if(ssl_cafile \|\| ssl_capath) {
+	/* tell wolfSSL where to find CA certificates that are used to verify
+	the server's certificate. */
+	int rc =
+	wolfSSL_CTX_load_verify_locations_ex(ctx->ssl_ctx, ssl_cafile,
+	ssl_capath,
+	WOLFSSL_LOAD_FLAG_IGNORE_ERR);
+	if(SSL_SUCCESS != rc) {
+	/* Fail if we insist on successfully verifying the server. */
+	failf(data, "error setting certificate verify locations:"
+	" CAfile: %s CApath: %s",
+	ssl_cafile ? ssl_cafile : "none",
+	ssl_capath ? ssl_capath : "none");
+	goto out;
+	}
+	infof(data, " CAfile: %s", ssl_cafile ? ssl_cafile : "none");
+	infof(data, " CApath: %s", ssl_capath ? ssl_capath : "none");
+	}
+	#ifdef CURL_CA_FALLBACK
+	else {
+	/* verifying the peer without any CA certificates won't work so
+	use wolfssl's built-in default as fallback */
+	wolfSSL_CTX_set_default_verify_paths(ctx->ssl_ctx);
+	}
+	#endif
+	}
+	else {
+	wolfSSL_CTX_set_verify(ctx->ssl_ctx, SSL_VERIFY_NONE, NULL);
+	}
+
+	/* give application a chance to interfere with SSL set up. */
+	if(data->set.ssl.fsslctx) {
+	Curl_set_in_callback(data, true);
+	result = (*data->set.ssl.fsslctx)(data, ctx->ssl_ctx,
+	data->set.ssl.fsslctxp);
+	Curl_set_in_callback(data, false);
+	if(result) {
+	failf(data, "error signaled by ssl ctx callback");
+	goto out;
+	}
+	}
+	result = CURLE_OK;
+
+	out:
+	if(result && ctx->ssl_ctx) {
+	SSL_CTX_free(ctx->ssl_ctx);
+	ctx->ssl_ctx = NULL;
+	}
+	return result;
+	}
+
+	/ SSL callbacks */
+
+	static CURLcode curl_wssl_init_ssl(struct quic_tls_ctx *ctx,
+	struct Curl_easy *data,
+	struct ssl_peer *peer,
+	const char *alpn, size_t alpn_len,
+	void *user_data)
+	{
+	(void)data;
+	DEBUGASSERT(!ctx->ssl);
+	DEBUGASSERT(ctx->ssl_ctx);
+	ctx->ssl = wolfSSL_new(ctx->ssl_ctx);
+
+	wolfSSL_set_app_data(ctx->ssl, user_data);
+	wolfSSL_set_connect_state(ctx->ssl);
+	wolfSSL_set_quic_use_legacy_codepoint(ctx->ssl, 0);
+
+	if(alpn)
+	wolfSSL_set_alpn_protos(ctx->ssl, (const unsigned char *)alpn,
+	(int)alpn_len);
+
+	if(peer->sni) {
+	wolfSSL_UseSNI(ctx->ssl, WOLFSSL_SNI_HOST_NAME,
+	peer->sni, (unsigned short)strlen(peer->sni));
+	}
+
+	return CURLE_OK;
+	}
+	#endif /* defined(USE_WOLFSSL) */
+
+	CURLcode Curl_vquic_tls_init(struct quic_tls_ctx *ctx,
+	struct Curl_cfilter *cf,
+	struct Curl_easy *data,
+	struct ssl_peer *peer,
+	const char *alpn, size_t alpn_len,
+	Curl_vquic_tls_ctx_setup *ctx_setup,
+	void *user_data)
+	{
+	CURLcode result;
+
+	#ifdef USE_OPENSSL
+	result = curl_ossl_init_ctx(ctx, cf, data, ctx_setup);
+	if(result)
+	return result;
+
+	result = curl_ossl_set_client_cert(ctx, cf, data);
+	if(result)
+	return result;
+
+	return curl_ossl_init_ssl(ctx, data, peer, alpn, alpn_len, user_data);
+	#elif defined(USE_GNUTLS)
+	(void)result;
+	return curl_gtls_init_ctx(ctx, cf, data, peer, alpn, alpn_len,
+	ctx_setup, user_data);
+	#elif defined(USE_WOLFSSL)
+	result = curl_wssl_init_ctx(ctx, cf, data, ctx_setup);
+	if(result)
+	return result;
+
+	return curl_wssl_init_ssl(ctx, data, peer, alpn, alpn_len, user_data);
+	#else
+	#error "no TLS lib in used, should not happen"
+	return CURLE_FAILED_INIT;
+	#endif
+	}
+
+	void Curl_vquic_tls_cleanup(struct quic_tls_ctx *ctx)
+	{
+	#ifdef USE_OPENSSL
+	if(ctx->ssl)
+	SSL_free(ctx->ssl);
+	if(ctx->ssl_ctx)
+	SSL_CTX_free(ctx->ssl_ctx);
+	#elif defined(USE_GNUTLS)
+	if(ctx->gtls) {
+	if(ctx->gtls->cred)
+	gnutls_certificate_free_credentials(ctx->gtls->cred);
+	if(ctx->gtls->session)
+	gnutls_deinit(ctx->gtls->session);
+	free(ctx->gtls);
+	}
+	#elif defined(USE_WOLFSSL)
+	if(ctx->ssl)
+	wolfSSL_free(ctx->ssl);
+	if(ctx->ssl_ctx)
+	wolfSSL_CTX_free(ctx->ssl_ctx);
+	#endif
+	memset(ctx, 0, sizeof(*ctx));
+	}
+
+	CURLcode Curl_vquic_tls_before_recv(struct quic_tls_ctx *ctx,
+	struct Curl_cfilter *cf,
+	struct Curl_easy *data)
+	{
+	#ifdef USE_OPENSSL
+	if(!ctx->x509_store_setup) {
+	CURLcode result = Curl_ssl_setup_x509_store(cf, data, ctx->ssl_ctx);
+	if(result)
+	return result;
+	ctx->x509_store_setup = TRUE;
+	}
+	#else
+	(void)ctx; (void)cf; (void)data;
+	#endif
+	return CURLE_OK;
+	}
+
+	CURLcode Curl_vquic_tls_verify_peer(struct quic_tls_ctx *ctx,
+	struct Curl_cfilter *cf,
+	struct Curl_easy *data,
+	struct ssl_peer *peer)
+	{
+	struct ssl_primary_config *conn_config;
+	CURLcode result = CURLE_OK;
+
+	conn_config = Curl_ssl_cf_get_primary_config(cf);
+	if(!conn_config)
+	return CURLE_FAILED_INIT;
+
+	if(conn_config->verifyhost) {
+	#ifdef USE_OPENSSL
+	X509 *server_cert;
+	server_cert = SSL_get1_peer_certificate(ctx->ssl);
+	if(!server_cert) {
+	return CURLE_PEER_FAILED_VERIFICATION;
+	}
+	result = Curl_ossl_verifyhost(data, cf->conn, peer, server_cert);
+	X509_free(server_cert);
+	if(result)
+	return result;
+	#elif defined(USE_GNUTLS)
+	result = Curl_gtls_verifyserver(data, ctx->gtls->session,
+	conn_config, &data->set.ssl, peer,
+	data->set.str[STRING_SSL_PINNEDPUBLICKEY]);
+	if(result)
+	return result;
+	#elif defined(USE_WOLFSSL)
+	if(!peer->sni \|\|
+	wolfSSL_check_domain_name(ctx->ssl, peer->sni) == SSL_FAILURE)
+	return CURLE_PEER_FAILED_VERIFICATION;
+	#endif
+	infof(data, "Verified certificate just fine");
+	}
+	else
+	infof(data, "Skipped certificate verification");
+	#ifdef USE_OPENSSL
+	if(data->set.ssl.certinfo)
+	/* asked to gather certificate info */
+	(void)Curl_ossl_certchain(data, ctx->ssl);
+	#endif
+	return result;
+	}
+
+
+	#endif /* !ENABLE_QUIC && (USE_OPENSSL \|\| USE_GNUTLS \|\| USE_WOLFSSL) */

lib/vquic/vquic-tls.h+98 -0

@@ -0,0 +1,98 @@
+	#ifndef HEADER_CURL_VQUIC_TLS_H
+	#define HEADER_CURL_VQUIC_TLS_H
+	/***************************************************************************
+	* _ _ ____ _
+	* Project ___\| \| \| \| _ \\| \|
+	* / __\| \| \| \| \|_) \| \|
+	* \| (__\| \|_\| \| _ <\| \|___
+	* \___\|\___/\|_\| \_\_____\|
+	*
+	* Copyright (C) Daniel Stenberg, <[email protected]>, et al.
+	*
+	* This software is licensed as described in the file COPYING, which
+	* you should have received as part of this distribution. The terms
+	* are also available at https://curl.se/docs/copyright.html.
+	*
+	* You may opt to use, copy, modify, merge, publish, distribute and/or sell
+	* copies of the Software, and permit persons to whom the Software is
+	* furnished to do so, under the terms of the COPYING file.
+	*
+	* This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+	* KIND, either express or implied.
+	*
+	* SPDX-License-Identifier: curl
+	*
+	***************************************************************************/
+
+	#include "curl_setup.h"
+	#include "bufq.h"
+
+	#if defined(ENABLE_QUIC) && \
+	(defined(USE_OPENSSL) \|\| defined(USE_GNUTLS) \|\| defined(USE_WOLFSSL))
+
+	struct quic_tls_ctx {
+	#ifdef USE_OPENSSL
+	SSL_CTX *ssl_ctx;
+	SSL *ssl;
+	#elif defined(USE_GNUTLS)
+	struct gtls_instance *gtls;
+	#elif defined(USE_WOLFSSL)
+	WOLFSSL_CTX *ssl_ctx;
+	WOLFSSL *ssl;
+	#endif
+	BIT(x509_store_setup); /* if x509 store has been set up */
+	};
+
+	/**
+	* Callback passed to `Curl_vquic_tls_init()` that can
+	* do early initializations on the not otherwise configured TLS
+	* instances created. This varies by TLS backend:
+	* - openssl/wolfssl: SSL_CTX* has just been created
+	* - gnutls: gtls_client_init() has run
+	*/
+	typedef CURLcode Curl_vquic_tls_ctx_setup(struct quic_tls_ctx *ctx,
+	struct Curl_cfilter *cf,
+	struct Curl_easy *data);
+
+	/**
+	* Initialize the QUIC TLS instances based of the SSL configurations
+	* for the connection filter, transfer and peer.
+	* @param ctx the TLS context to initialize
+	* @param cf the connection filter involved
+	* @param data the transfer involved
+	* @param peer the peer that will be connected to
+	* @param alpn the ALPN string in protocol format ((len+bytes+)+),
+	* may be NULL
+	* @param alpn_len the overall number of bytes in `alpn`
+	* @param ctx_setup optional callback for very early TLS config
+	* @param user_data optional pointer to set in TLS application context
+	*/
+	CURLcode Curl_vquic_tls_init(struct quic_tls_ctx *ctx,
+	struct Curl_cfilter *cf,
+	struct Curl_easy *data,
+	struct ssl_peer *peer,
+	const char *alpn, size_t alpn_len,
+	Curl_vquic_tls_ctx_setup *ctx_setup,
+	void *user_data);
+
+	/**
+	* Cleanup all data that has been initialized.
+	*/
+	void Curl_vquic_tls_cleanup(struct quic_tls_ctx *ctx);
+
+	CURLcode Curl_vquic_tls_before_recv(struct quic_tls_ctx *ctx,
+	struct Curl_cfilter *cf,
+	struct Curl_easy *data);
+
+	/**
+	* After the QUIC basic handshake has been, verify that the peer
+	* (and its certificate) fulfill our requirements.
+	*/
+	CURLcode Curl_vquic_tls_verify_peer(struct quic_tls_ctx *ctx,
+	struct Curl_cfilter *cf,
+	struct Curl_easy *data,
+	struct ssl_peer *peer);
+
+	#endif /* !ENABLE_QUIC && (USE_OPENSSL \|\| USE_GNUTLS \|\| USE_WOLFSSL) */
+
+	#endif /* HEADER_CURL_VQUIC_TLS_H */

lib/vquic/vquic.c+6 -1

@@ -543,8 +543,13 @@ CURLcode vquic_recv_packets(struct Curl_cfilter *cf,
	#else
	result = recvfrom_packets(cf, data, qctx, max_pkts, recv_cb, userp);
	#endif
-	if(!result)
+	if(!result) {
+	if(!qctx->got_first_byte) {
+	qctx->got_first_byte = TRUE;
+	qctx->first_byte_at = qctx->last_op;
+	}
	qctx->last_io = qctx->last_op;
+	}
	return result;
	}

lib/vquic/vquic_int.h+3 -1

@@ -40,6 +40,7 @@ struct cf_quic_ctx {
	socklen_t local_addrlen; /* length of local address */

	struct bufq sendbuf; /* buffer for sending one or more packets */
+	struct curltime first_byte_at; /* when first byte was recvd */
	struct curltime last_op; /* last (attempted) send/recv operation */
	struct curltime last_io; /* last successful socket IO */
	size_t gsolen; /* length of individual packets in send buf */
@@ -48,7 +49,8 @@ struct cf_quic_ctx {
	#ifdef DEBUGBUILD
	int wblock_percent; /* percent of writes doing EAGAIN */
	#endif
-	bool no_gso; /* do not use gso on sending */
+	BIT(got_first_byte); /* if first byte was received */
+	BIT(no_gso); /* do not use gso on sending */
	};

	CURLcode vquic_ctx_init(struct cf_quic_ctx *qctx);

tests/http/test_01_basic.py+15 -0

@@ -84,3 +84,18 @@ class TestBasic:
	r = curl.http_get(url=url, extra_args=['--http3-only'])
	r.check_response(http_status=200, protocol='HTTP/3')
	assert r.json['server'] == env.domain1
+
+	# simple download, check connect/handshake timings
+	@pytest.mark.skipif(condition=not Env.have_ssl_curl(), reason=f"curl without SSL")
+	@pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
+	def test_01_06_timings(self, env: Env, httpd, nghttpx, repeat, proto):
+	if proto == 'h3' and not env.have_h3():
+	pytest.skip("h3 not supported")
+	curl = CurlClient(env=env)
+	url = f'https://{env.authority_for(env.domain1, proto)}/data.json'
+	r = curl.http_download(urls=[url], alpn_proto=proto, with_stats=True)
+	r.check_stats(http_status=200, count=1)
+	assert r.stats[0]['time_connect'] > 0, f'{r.stats[0]}'
+	assert r.stats[0]['time_appconnect'] > 0, f'{r.stats[0]}'
+
+