← Commit list

962097b8dd

Stefan Eissing

2024-10-11

SUCCESS Duration: 114s

Subject

TLS: TLSv1.3 earlydata support for curl

Binary

Download Binary (870 KB)

Architecture & Compiler Flags

Architecture: x86_64-linux-gnu Compiler: gcc (Ubuntu 11.4.0-1ubuntu1~22.04.3) 11.4.0

—

Build Log

$ git checkout -f 962097b8dd44ed5b9e7984bc1cdffdbdd566857f
Previous HEAD position was 3b43a05e00 netrc: cache the netrc file in memory
HEAD is now at 962097b8dd TLS: TLSv1.3 earlydata support for curl

$ git clean -fdx
Removing Makefile
Removing Makefile.in
Removing aclocal.m4
Removing autom4te.cache/
Removing buildinfo.txt
Removing compile
Removing config.guess
Removing config.log
Removing config.status
Removing config.sub
Removing configure
Removing curl-config
Removing depcomp
Removing docs/Makefile
Removing docs/Makefile.in
Removing docs/cmdline-opts/Makefile
Removing docs/cmdline-opts/Makefile.in
Removing docs/examples/.deps/
Removing docs/examples/Makefile
Removing docs/examples/Makefile.in
Removing docs/libcurl/Makefile
Removing docs/libcurl/Makefile.in
Removing docs/libcurl/opts/Makefile
Removing docs/libcurl/opts/Makefile.in
Removing include/Makefile
Removing include/Makefile.in
Removing include/curl/Makefile
Removing include/curl/Makefile.in
Removing install-sh
Removing lib/.deps/
Removing lib/.dirstamp
Removing lib/.libs/
Removing lib/Makefile
Removing lib/Makefile.in
Removing lib/base64.o
Removing lib/curl_config.h
Removing lib/curl_config.h.in
Removing lib/curl_multibyte.o
Removing lib/dynbuf.o
Removing lib/libcurl.la
Removing lib/libcurl.vers
Removing lib/libcurl_la-altsvc.lo
Removing lib/libcurl_la-altsvc.o
Removing lib/libcurl_la-amigaos.lo
Removing lib/libcurl_la-amigaos.o
Removing lib/libcurl_la-asyn-ares.lo
Removing lib/libcurl_la-asyn-ares.o
Removing lib/libcurl_la-asyn-thread.lo
Removing lib/libcurl_la-asyn-thread.o
Removing lib/libcurl_la-base64.lo
Removing lib/libcurl_la-base64.o
Removing lib/libcurl_la-bufq.lo
Removing lib/libcurl_la-bufq.o
Removing lib/libcurl_la-bufref.lo
Removing lib/libcurl_la-bufref.o
Removing lib/libcurl_la-c-hyper.lo
Removing lib/libcurl_la-c-hyper.o
Removing lib/libcurl_la-cf-h1-proxy.lo
Removing lib/libcurl_la-cf-h1-proxy.o
Removing lib/libcurl_la-cf-h2-proxy.lo
Removing lib/libcurl_la-cf-h2-proxy.o
Removing lib/libcurl_la-cf-haproxy.lo
Removing lib/libcurl_la-cf-haproxy.o
Removing lib/libcurl_la-cf-https-connect.lo
Removing lib/libcurl_la-cf-https-connect.o
Removing lib/libcurl_la-cf-socket.lo
Removing lib/libcurl_la-cf-socket.o
Removing lib/libcurl_la-cfilters.lo
Removing lib/libcurl_la-cfilters.o
Removing lib/libcurl_la-conncache.lo
Removing lib/libcurl_la-conncache.o
Removing lib/libcurl_la-connect.lo
Removing lib/libcurl_la-connect.o
Removing lib/libcurl_la-content_encoding.lo
Removing lib/libcurl_la-content_encoding.o
Removing lib/libcurl_la-cookie.lo
Removing lib/libcurl_la-cookie.o
Removing lib/libcurl_la-curl_addrinfo.lo
Removing lib/libcurl_la-curl_addrinfo.o
Removing lib/libcurl_la-curl_des.lo
Removing lib/libcurl_la-curl_des.o
Removing lib/libcurl_la-curl_endian.lo
Removing lib/libcurl_la-curl_endian.o
Removing lib/libcurl_la-curl_fnmatch.lo
Removing lib/libcurl_la-curl_fnmatch.o
Removing lib/libcurl_la-curl_get_line.lo
Removing lib/libcurl_la-curl_get_line.o
Removing lib/libcurl_la-curl_gethostname.lo
Removing lib/libcurl_la-curl_gethostname.o
Removing lib/libcurl_la-curl_gssapi.lo
Removing lib/libcurl_la-curl_gssapi.o
Removing lib/libcurl_la-curl_memrchr.lo
Removing lib/libcurl_la-curl_memrchr.o
Removing lib/libcurl_la-curl_multibyte.lo
Removing lib/libcurl_la-curl_multibyte.o
Removing lib/libcurl_la-curl_ntlm_core.lo
Removing lib/libcurl_la-curl_ntlm_core.o
Removing lib/libcurl_la-curl_path.lo
Removing lib/libcurl_la-curl_path.o
Removing lib/libcurl_la-curl_range.lo
Removing lib/libcurl_la-curl_range.o
Removing lib/libcurl_la-curl_rtmp.lo
Removing lib/libcurl_la-curl_rtmp.o
Removing lib/libcurl_la-curl_sasl.lo
Removing lib/libcurl_la-curl_sasl.o
Removing lib/libcurl_la-curl_sha512_256.lo
Removing lib/libcurl_la-curl_sha512_256.o
Removing lib/libcurl_la-curl_sspi.lo
Removing lib/libcurl_la-curl_sspi.o
Removing lib/libcurl_la-curl_threads.lo
Removing lib/libcurl_la-curl_threads.o
Removing lib/libcurl_la-curl_trc.lo
Removing lib/libcurl_la-curl_trc.o
Removing lib/libcurl_la-cw-out.lo
Removing lib/libcurl_la-cw-out.o
Removing lib/libcurl_la-dict.lo
Removing lib/libcurl_la-dict.o
Removing lib/libcurl_la-dllmain.lo
Removing lib/libcurl_la-dllmain.o
Removing lib/libcurl_la-doh.lo
Removing lib/libcurl_la-doh.o
Removing lib/libcurl_la-dynbuf.lo
Removing lib/libcurl_la-dynbuf.o
Removing lib/libcurl_la-dynhds.lo
Removing lib/libcurl_la-dynhds.o
Removing lib/libcurl_la-easy.lo
Removing lib/libcurl_la-easy.o
Removing lib/libcurl_la-easygetopt.lo
Removing lib/libcurl_la-easygetopt.o
Removing lib/libcurl_la-easyoptions.lo
Removing lib/libcurl_la-easyoptions.o
Removing lib/libcurl_la-escape.lo
Removing lib/libcurl_la-escape.o
Removing lib/libcurl_la-file.lo
Removing lib/libcurl_la-file.o
Removing lib/libcurl_la-fileinfo.lo
Removing lib/libcurl_la-fileinfo.o
Removing lib/libcurl_la-fopen.lo
Removing lib/libcurl_la-fopen.o
Removing lib/libcurl_la-formdata.lo
Removing lib/libcurl_la-formdata.o
Removing lib/libcurl_la-ftp.lo
Removing lib/libcurl_la-ftp.o
Removing lib/libcurl_la-ftplistparser.lo
Removing lib/libcurl_la-ftplistparser.o
Removing lib/libcurl_la-getenv.lo
Removing lib/libcurl_la-getenv.o
Removing lib/libcurl_la-getinfo.lo
Removing lib/libcurl_la-getinfo.o
Removing lib/libcurl_la-gopher.lo
Removing lib/libcurl_la-gopher.o
Removing lib/libcurl_la-hash.lo
Removing lib/libcurl_la-hash.o
Removing lib/libcurl_la-headers.lo
Removing lib/libcurl_la-headers.o
Removing lib/libcurl_la-hmac.lo
Removing lib/libcurl_la-hmac.o
Removing lib/libcurl_la-hostasyn.lo
Removing lib/libcurl_la-hostasyn.o
Removing lib/libcurl_la-hostip.lo
Removing lib/libcurl_la-hostip.o
Removing lib/libcurl_la-hostip4.lo
Removing lib/libcurl_la-hostip4.o
Removing lib/libcurl_la-hostip6.lo
Removing lib/libcurl_la-hostip6.o
Removing lib/libcurl_la-hostsyn.lo
Removing lib/libcurl_la-hostsyn.o
Removing lib/libcurl_la-hsts.lo
Removing lib/libcurl_la-hsts.o
Removing lib/libcurl_la-http.lo
Removing lib/libcurl_la-http.o
Removing lib/libcurl_la-http1.lo
Removing lib/libcurl_la-http1.o
Removing lib/libcurl_la-http2.lo
Removing lib/libcurl_la-http2.o
Removing lib/libcurl_la-http_aws_sigv4.lo
Removing lib/libcurl_la-http_aws_sigv4.o
Removing lib/libcurl_la-http_chunks.lo
Removing lib/libcurl_la-http_chunks.o
Removing lib/libcurl_la-http_digest.lo
Removing lib/libcurl_la-http_digest.o
Removing lib/libcurl_la-http_negotiate.lo
Removing lib/libcurl_la-http_negotiate.o
Removing lib/libcurl_la-http_ntlm.lo
Removing lib/libcurl_la-http_ntlm.o
Removing lib/libcurl_la-http_proxy.lo
Removing lib/libcurl_la-http_proxy.o
Removing lib/libcurl_la-idn.lo
Removing lib/libcurl_la-idn.o
Removing lib/libcurl_la-if2ip.lo
Removing lib/libcurl_la-if2ip.o
Removing lib/libcurl_la-imap.lo
Removing lib/libcurl_la-imap.o
Removing lib/libcurl_la-inet_ntop.lo
Removing lib/libcurl_la-inet_ntop.o
Removing lib/libcurl_la-inet_pton.lo
Removing lib/libcurl_la-inet_pton.o
Removing lib/libcurl_la-krb5.lo
Removing lib/libcurl_la-krb5.o
Removing lib/libcurl_la-ldap.lo
Removing lib/libcurl_la-ldap.o
Removing lib/libcurl_la-llist.lo
Removing lib/libcurl_la-llist.o
Removing lib/libcurl_la-macos.lo
Removing lib/libcurl_la-macos.o
Removing lib/libcurl_la-md4.lo
Removing lib/libcurl_la-md4.o
Removing lib/libcurl_la-md5.lo
Removing lib/libcurl_la-md5.o
Removing lib/libcurl_la-memdebug.lo
Removing lib/libcurl_la-memdebug.o
Removing lib/libcurl_la-mime.lo
Removing lib/libcurl_la-mime.o
Removing lib/libcurl_la-mprintf.lo
Removing lib/libcurl_la-mprintf.o
Removing lib/libcurl_la-mqtt.lo
Removing lib/libcurl_la-mqtt.o
Removing lib/libcurl_la-multi.lo
Removing lib/libcurl_la-multi.o
Removing lib/libcurl_la-netrc.lo
Removing lib/libcurl_la-netrc.o
Removing lib/libcurl_la-nonblock.lo
Removing lib/libcurl_la-nonblock.o
Removing lib/libcurl_la-noproxy.lo
Removing lib/libcurl_la-noproxy.o
Removing lib/libcurl_la-openldap.lo
Removing lib/libcurl_la-openldap.o
Removing lib/libcurl_la-parsedate.lo
Removing lib/libcurl_la-parsedate.o
Removing lib/libcurl_la-pingpong.lo
Removing lib/libcurl_la-pingpong.o
Removing lib/libcurl_la-pop3.lo
Removing lib/libcurl_la-pop3.o
Removing lib/libcurl_la-progress.lo
Removing lib/libcurl_la-progress.o
Removing lib/libcurl_la-psl.lo
Removing lib/libcurl_la-psl.o
Removing lib/libcurl_la-rand.lo
Removing lib/libcurl_la-rand.o
Removing lib/libcurl_la-rename.lo
Removing lib/libcurl_la-rename.o
Removing lib/libcurl_la-request.lo
Removing lib/libcurl_la-request.o
Removing lib/libcurl_la-rtsp.lo
Removing lib/libcurl_la-rtsp.o
Removing lib/libcurl_la-select.lo
Removing lib/libcurl_la-select.o
Removing lib/libcurl_la-sendf.lo
Removing lib/libcurl_la-sendf.o
Removing lib/libcurl_la-setopt.lo
Removing lib/libcurl_la-setopt.o
Removing lib/libcurl_la-sha256.lo
Removing lib/libcurl_la-sha256.o
Removing lib/libcurl_la-share.lo
Removing lib/libcurl_la-share.o
Removing lib/libcurl_la-slist.lo
Removing lib/libcurl_la-slist.o
Removing lib/libcurl_la-smb.lo
Removing lib/libcurl_la-smb.o
Removing lib/libcurl_la-smtp.lo
Removing lib/libcurl_la-smtp.o
Removing lib/libcurl_la-socketpair.lo
Removing lib/libcurl_la-socketpair.o
Removing lib/libcurl_la-socks.lo
Removing lib/libcurl_la-socks.o
Removing lib/libcurl_la-socks_gssapi.lo
Removing lib/libcurl_la-socks_gssapi.o
Removing lib/libcurl_la-socks_sspi.lo
Removing lib/libcurl_la-socks_sspi.o
Removing lib/libcurl_la-speedcheck.lo
Removing lib/libcurl_la-speedcheck.o
Removing lib/libcurl_la-splay.lo
Removing lib/libcurl_la-splay.o
Removing lib/libcurl_la-strcase.lo
Removing lib/libcurl_la-strcase.o
Removing lib/libcurl_la-strdup.lo
Removing lib/libcurl_la-strdup.o
Removing lib/libcurl_la-strerror.lo
Removing lib/libcurl_la-strerror.o
Removing lib/libcurl_la-strtok.lo
Removing lib/libcurl_la-strtok.o
Removing lib/libcurl_la-strtoofft.lo
Removing lib/libcurl_la-strtoofft.o
Removing lib/libcurl_la-system_win32.lo
Removing lib/libcurl_la-system_win32.o
Removing lib/libcurl_la-telnet.lo
Removing lib/libcurl_la-telnet.o
Removing lib/libcurl_la-tftp.lo
Removing lib/libcurl_la-tftp.o
Removing lib/libcurl_la-timediff.lo
Removing lib/libcurl_la-timediff.o
Removing lib/libcurl_la-timeval.lo
Removing lib/libcurl_la-timeval.o
Removing lib/libcurl_la-transfer.lo
Removing lib/libcurl_la-transfer.o
Removing lib/libcurl_la-url.lo
Removing lib/libcurl_la-url.o
Removing lib/libcurl_la-urlapi.lo
Removing lib/libcurl_la-urlapi.o
Removing lib/libcurl_la-version.lo
Removing lib/libcurl_la-version.o
Removing lib/libcurl_la-version_win32.lo
Removing lib/libcurl_la-version_win32.o
Removing lib/libcurl_la-warnless.lo
Removing lib/libcurl_la-warnless.o
Removing lib/libcurl_la-ws.lo
Removing lib/libcurl_la-ws.o
Removing lib/nonblock.o
Removing lib/stamp-h1
Removing lib/strtoofft.o
Removing lib/timediff.o
Removing lib/vauth/.deps/
Removing lib/vauth/.dirstamp
Removing lib/vauth/libcurl_la-cleartext.lo
Removing lib/vauth/libcurl_la-cleartext.o
Removing lib/vauth/libcurl_la-cram.lo
Removing lib/vauth/libcurl_la-cram.o
Removing lib/vauth/libcurl_la-digest.lo
Removing lib/vauth/libcurl_la-digest.o
Removing lib/vauth/libcurl_la-digest_sspi.lo
Removing lib/vauth/libcurl_la-digest_sspi.o
Removing lib/vauth/libcurl_la-gsasl.lo
Removing lib/vauth/libcurl_la-gsasl.o
Removing lib/vauth/libcurl_la-krb5_gssapi.lo
Removing lib/vauth/libcurl_la-krb5_gssapi.o
Removing lib/vauth/libcurl_la-krb5_sspi.lo
Removing lib/vauth/libcurl_la-krb5_sspi.o
Removing lib/vauth/libcurl_la-ntlm.lo
Removing lib/vauth/libcurl_la-ntlm.o
Removing lib/vauth/libcurl_la-ntlm_sspi.lo
Removing lib/vauth/libcurl_la-ntlm_sspi.o
Removing lib/vauth/libcurl_la-oauth2.lo
Removing lib/vauth/libcurl_la-oauth2.o
Removing lib/vauth/libcurl_la-spnego_gssapi.lo
Removing lib/vauth/libcurl_la-spnego_gssapi.o
Removing lib/vauth/libcurl_la-spnego_sspi.lo
Removing lib/vauth/libcurl_la-spnego_sspi.o
Removing lib/vauth/libcurl_la-vauth.lo
Removing lib/vauth/libcurl_la-vauth.o
Removing lib/version_win32.o
Removing lib/vquic/.deps/
Removing lib/vquic/.dirstamp
Removing lib/vquic/libcurl_la-curl_msh3.lo
Removing lib/vquic/libcurl_la-curl_msh3.o
Removing lib/vquic/libcurl_la-curl_ngtcp2.lo
Removing lib/vquic/libcurl_la-curl_ngtcp2.o
Removing lib/vquic/libcurl_la-curl_osslq.lo
Removing lib/vquic/libcurl_la-curl_osslq.o
Removing lib/vquic/libcurl_la-curl_quiche.lo
Removing lib/vquic/libcurl_la-curl_quiche.o
Removing lib/vquic/libcurl_la-vquic-tls.lo
Removing lib/vquic/libcurl_la-vquic-tls.o
Removing lib/vquic/libcurl_la-vquic.lo
Removing lib/vquic/libcurl_la-vquic.o
Removing lib/vssh/.deps/
Removing lib/vssh/.dirstamp
Removing lib/vssh/libcurl_la-libssh.lo
Removing lib/vssh/libcurl_la-libssh.o
Removing lib/vssh/libcurl_la-libssh2.lo
Removing lib/vssh/libcurl_la-libssh2.o
Removing lib/vssh/libcurl_la-wolfssh.lo
Removing lib/vssh/libcurl_la-wolfssh.o
Removing lib/vtls/.deps/
Removing lib/vtls/.dirstamp
Removing lib/vtls/libcurl_la-bearssl.lo
Removing lib/vtls/libcurl_la-bearssl.o
Removing lib/vtls/libcurl_la-cipher_suite.lo
Removing lib/vtls/libcurl_la-cipher_suite.o
Removing lib/vtls/libcurl_la-gtls.lo
Removing lib/vtls/libcurl_la-gtls.o
Removing lib/vtls/libcurl_la-hostcheck.lo
Removing lib/vtls/libcurl_la-hostcheck.o
Removing lib/vtls/libcurl_la-keylog.lo
Removing lib/vtls/libcurl_la-keylog.o
Removing lib/vtls/libcurl_la-mbedtls.lo
Removing lib/vtls/libcurl_la-mbedtls.o
Removing lib/vtls/libcurl_la-mbedtls_threadlock.lo
Removing lib/vtls/libcurl_la-mbedtls_threadlock.o
Removing lib/vtls/libcurl_la-openssl.lo
Removing lib/vtls/libcurl_la-openssl.o
Removing lib/vtls/libcurl_la-rustls.lo
Removing lib/vtls/libcurl_la-rustls.o
Removing lib/vtls/libcurl_la-schannel.lo
Removing lib/vtls/libcurl_la-schannel.o
Removing lib/vtls/libcurl_la-schannel_verify.lo
Removing lib/vtls/libcurl_la-schannel_verify.o
Removing lib/vtls/libcurl_la-sectransp.lo
Removing lib/vtls/libcurl_la-sectransp.o
Removing lib/vtls/libcurl_la-vtls.lo
Removing lib/vtls/libcurl_la-vtls.o
Removing lib/vtls/libcurl_la-wolfssl.lo
Removing lib/vtls/libcurl_la-wolfssl.o
Removing lib/vtls/libcurl_la-x509asn1.lo
Removing lib/vtls/libcurl_la-x509asn1.o
Removing lib/warnless.o
Removing libcurl.pc
Removing libtool
Removing ltmain.sh
Removing m4/libtool.m4
Removing m4/ltoptions.m4
Removing m4/ltsugar.m4
Removing m4/ltversion.m4
Removing m4/lt~obsolete.m4
Removing missing
Removing packages/Makefile
Removing packages/Makefile.in
Removing packages/vms/Makefile
Removing packages/vms/Makefile.in
Removing scripts/Makefile
Removing scripts/Makefile.in
Removing src/.deps/
Removing src/.libs/
Removing src/Makefile
Removing src/Makefile.in
Removing src/curl
Removing src/slist_wc.o
Removing src/terminal.o
Removing src/tool_binmode.o
Removing src/tool_bname.o
Removing src/tool_ca_embed.c
Removing src/tool_ca_embed.o
Removing src/tool_cb_dbg.o
Removing src/tool_cb_hdr.o
Removing src/tool_cb_prg.o
Removing src/tool_cb_rea.o
Removing src/tool_cb_see.o
Removing src/tool_cb_soc.o
Removing src/tool_cb_wrt.o
Removing src/tool_cfgable.o
Removing src/tool_dirhie.o
Removing src/tool_doswin.o
Removing src/tool_easysrc.o
Removing src/tool_filetime.o
Removing src/tool_findfile.o
Removing src/tool_formparse.o
Removing src/tool_getparam.o
Removing src/tool_getpass.o
Removing src/tool_help.o
Removing src/tool_helpers.o
Removing src/tool_hugehelp.c
Removing src/tool_hugehelp.o
Removing src/tool_ipfs.o
Removing src/tool_libinfo.o
Removing src/tool_listhelp.o
Removing src/tool_main.o
Removing src/tool_msgs.o
Removing src/tool_operate.o
Removing src/tool_operhlp.o
Removing src/tool_paramhlp.o
Removing src/tool_parsecfg.o
Removing src/tool_progress.o
Removing src/tool_setopt.o
Removing src/tool_sleep.o
Removing src/tool_stderr.o
Removing src/tool_strdup.o
Removing src/tool_urlglob.o
Removing src/tool_util.o
Removing src/tool_vms.o
Removing src/tool_writeout.o
Removing src/tool_writeout_json.o
Removing src/tool_xattr.o
Removing src/var.o
Removing tests/Makefile
Removing tests/Makefile.in
Removing tests/certs/Makefile
Removing tests/certs/Makefile.in
Removing tests/certs/scripts/Makefile
Removing tests/certs/scripts/Makefile.in
Removing tests/config
Removing tests/configurehelp.pm
Removing tests/data/Makefile
Removing tests/data/Makefile.in
Removing tests/http/Makefile
Removing tests/http/Makefile.in
Removing tests/http/clients/.deps/
Removing tests/http/clients/Makefile
Removing tests/http/clients/Makefile.in
Removing tests/http/config.ini
Removing tests/libtest/.deps/
Removing tests/libtest/Makefile
Removing tests/libtest/Makefile.in
Removing tests/server/.deps/
Removing tests/server/Makefile
Removing tests/server/Makefile.in
Removing tests/unit/.deps/
Removing tests/unit/Makefile
Removing tests/unit/Makefile.in

$ autoreconf -fi
libtoolize: putting auxiliary files in '.'.
libtoolize: copying file './ltmain.sh'
libtoolize: putting macros in AC_CONFIG_MACRO_DIRS, 'm4'.
libtoolize: copying file 'm4/libtool.m4'
libtoolize: copying file 'm4/ltoptions.m4'
libtoolize: copying file 'm4/ltsugar.m4'
libtoolize: copying file 'm4/ltversion.m4'
libtoolize: copying file 'm4/lt~obsolete.m4'
libtoolize: Remember to add 'LT_INIT' to configure.ac.
configure.ac:125: installing './compile'
configure.ac:437: installing './config.guess'
configure.ac:437: installing './config.sub'
configure.ac:125: installing './install-sh'
configure.ac:131: installing './missing'
docs/examples/Makefile.am: installing './depcomp'

$ bash -c find . -name config.guess -exec cp /usr/share/misc/config.guess {} \;

$ bash -c find . -name config.sub -exec cp /usr/share/misc/config.sub {} \;

$ chmod +x configure

$ ./configure --disable-shared --without-ssl --disable-docs
checking whether to enable maintainer-specific portions of Makefiles... no
checking whether make supports nested variables... yes
checking whether to enable debug build options... no
checking whether to enable compiler optimizer... (assumed) yes
checking whether to enable strict compiler warnings... no
checking whether to enable compiler warnings as errors... no
checking whether to enable curl debug memory tracking... no
checking whether to enable hiding of library internal symbols... yes
checking whether to enable c-ares for DNS lookups... no
checking whether to disable dependency on -lrt... (assumed no)
checking whether to enable HTTPSRR support... no
checking whether to enable ECH support... no
checking for path separator... :
checking for sed... /usr/bin/sed
checking for grep... /usr/bin/grep
checking that grep -E works... yes
checking for ar... /usr/bin/ar
checking for a BSD-compatible install... /usr/bin/install -c
checking for gcc... ccache gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables...
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether the compiler supports GNU C... yes
checking whether ccache gcc accepts -g... yes
checking for ccache gcc option to enable C11 features... none needed
checking whether ccache gcc understands -c and -o together... yes
checking how to run the C preprocessor... ccache gcc -E
checking for stdio.h... yes
checking for stdlib.h... yes
checking for string.h... yes
checking for inttypes.h... yes
checking for stdint.h... yes
checking for strings.h... yes
checking for sys/stat.h... yes
checking for sys/types.h... yes
checking for unistd.h... yes
checking for stdatomic.h... yes
checking if _Atomic is available... yes
checking for a sed that does not truncate output... (cached) /usr/bin/sed
checking for code coverage support... no
checking whether build environment is sane... yes
checking for a race-free mkdir -p... /usr/bin/mkdir -p
checking for gawk... gawk
checking whether make sets $(MAKE)... yes
checking whether make supports the include directive... yes (GNU style)
checking dependency style of ccache gcc... gcc3
checking curl version... 8.11.0-DEV
checking for httpd... no
checking for apache2... no
checking for apachectl... no
checking for apxs... no
configure: httpd/apache2 not in PATH, http tests disabled
configure: apxs not in PATH, http tests disabled
checking for nghttpx... no
checking for caddy... /usr/bin/caddy
checking build system type... x86_64-pc-linux-gnu
checking host system type... x86_64-pc-linux-gnu
checking for grep that handles long lines and -e... (cached) /usr/bin/grep
checking for egrep... /usr/bin/grep -E
checking if OS is AIX (to define _ALL_SOURCE)... no
checking if _THREAD_SAFE is already defined... no
checking if _THREAD_SAFE is actually needed... no
checking if _THREAD_SAFE is onwards defined... no
checking if _REENTRANT is already defined... no
checking if _REENTRANT is actually needed... no
checking if _REENTRANT is onwards defined... no
checking for special C compiler options needed for large files... no
checking for _FILE_OFFSET_BITS value needed for large files... no
checking how to print strings... printf
checking for a sed that does not truncate output... (cached) /usr/bin/sed
checking for fgrep... /usr/bin/grep -F
checking for ld used by ccache gcc... /usr/bin/ld
checking if the linker (/usr/bin/ld) is GNU ld... yes
checking for BSD- or MS-compatible name lister (nm)... /usr/bin/nm -B
checking the name lister (/usr/bin/nm -B) interface... BSD nm
checking whether ln -s works... yes
checking the maximum length of command line arguments... 1572864
checking how to convert x86_64-pc-linux-gnu file names to x86_64-pc-linux-gnu format... func_convert_file_noop
checking how to convert x86_64-pc-linux-gnu file names to toolchain format... func_convert_file_noop
checking for /usr/bin/ld option to reload object files... -r
checking for objdump... objdump
checking how to recognize dependent libraries... pass_all
checking for dlltool... no
checking how to associate runtime and link libraries... printf %s\n
checking for archiver @FILE support... @
checking for strip... strip
checking for ranlib... ranlib
checking command to parse /usr/bin/nm -B output from ccache gcc object... ok
checking for sysroot... no
checking for a working dd... /usr/bin/dd
checking how to truncate binary pipes... /usr/bin/dd bs=4096 count=1
checking for mt... mt
checking if mt is a manifest tool... no
checking for dlfcn.h... yes
checking for objdir... .libs
checking if ccache gcc supports -fno-rtti -fno-exceptions... no
checking for ccache gcc option to produce PIC... -fPIC -DPIC
checking if ccache gcc PIC flag -fPIC -DPIC works... yes
checking if ccache gcc static flag -static works... yes
checking if ccache gcc supports -c -o file.o... yes
checking if ccache gcc supports -c -o file.o... (cached) yes
checking whether the ccache gcc linker (/usr/bin/ld -m elf_x86_64) supports shared libraries... yes
checking dynamic linker characteristics... GNU/Linux ld.so
checking how to hardcode library paths into programs... immediate
checking whether stripping libraries is possible... yes
checking if libtool supports shared libraries... yes
checking whether to build shared libraries... no
checking whether to build static libraries... yes
checking whether to build shared libraries with -version-info... yes
checking whether to build shared libraries with -no-undefined... no
checking whether to build shared libraries with -mimpure-text... no
checking whether to build shared libraries with PIC... yes
checking whether to build static libraries with PIC... yes
checking whether to build shared libraries only... no
checking whether to build static libraries only... yes
checking for windres... no
checking if cpp -P is needed... yes
checking if cpp -P works... yes
checking if compiler is DEC/Compaq/HP C... no
checking if compiler is HP-UX C... no
checking if compiler is IBM C... no
checking if compiler is Intel C... no
checking if compiler is clang... no
checking if compiler is GNU C... yes
checking compiler version... gcc '1100' (raw: '11')
checking if compiler is SunPro C... no
checking if compiler is Tiny C... no
checking whether build target is a native Windows one... no
checking if compiler accepts some basic options... yes
configure: compiler options added: -Werror-implicit-function-declaration
checking if compiler optimizer assumed setting might be used... yes
checking if compiler accepts optimizer enabling options... yes
configure: compiler options added: -O2
checking if compiler accepts strict warning options... yes
configure: compiler options added: -Wno-system-headers
checking if compiler halts on compilation errors... yes
checking if compiler halts on negative sized arrays... yes
checking if compiler halts on function prototype mismatch... yes
checking if compiler supports hiding library internal symbols... yes
checking whether build target supports Win32 file API... no
checking whether build target supports Win32 crypto API... no
checking for good-to-use Darwin CFLAGS... no
checking whether to build libcurl and curl in "unity" mode... no
checking whether to build tests into single-binary bundles... no
checking whether to support http... yes
checking whether to support ftp... yes
checking whether to support file... yes
checking whether to support IPFS... yes
checking whether to support ldap... yes
checking whether to support ldaps... yes
checking whether to support rtsp... yes
checking whether to support proxies... yes
checking whether to support dict... yes
checking whether to support telnet... yes
checking whether to support tftp... yes
checking whether to support pop3... yes
checking whether to support imap... yes
checking whether to support smb... yes
checking whether to support smtp... yes
checking whether to support gopher... yes
checking whether to support mqtt... no
checking whether to provide built-in manual... yes
checking whether to build documentation... no
checking whether to enable generation of C code... yes
checking whether to use libgcc... no
checking if X/Open network library is required... no
checking for gethostbyname... yes
checking whether build target is a native Windows one... (cached) no
checking for proto/bsdsocket.h... no
checking for connect in libraries... yes
checking for sys/types.h... (cached) yes
checking for sys/time.h... yes
checking for monotonic clock_gettime... yes
checking for clock_gettime in libraries... no additional lib required
checking if monotonic clock_gettime works... yes
checking for sys/types.h... (cached) yes
checking for sys/time.h... (cached) yes
checking for raw monotonic clock_gettime... yes
checking for pkg-config... /usr/bin/pkg-config
checking for zlib options with pkg-config... found
checking for zlib.h... yes
configure: found both libz and libz.h header
checking for BrotliDecoderDecompress in -lbrotlidec... no
checking for brotli/decode.h... no
checking for ZSTD_createDStream in -lzstd... no
checking for zstd.h... no
checking for lber.h... no
checking for ldap.h... no
checking for ldap_ssl.h... no
checking for LDAP libraries... cannot find LDAP libraries
checking whether to enable IPv6... yes
checking if struct sockaddr_in6 has sin6_scope_id member... yes
checking if argv can be written to... yes
checking if GSS-API support is requested... no
checking whether to enable Windows native SSL/TLS... no
checking whether to enable Secure Transport... no
checking whether to enable Amiga native SSL/TLS (AmiSSL v5)... no
checking for pkg-config... (cached) /usr/bin/pkg-config
checking for libpsl options with pkg-config... found
checking for psl_builtin in -lpsl... yes
checking for libpsl.h... yes
checking for library containing gsasl_init... no
checking for RTMP_Init in -lrtmp... no
checking whether versioned symbols are wanted... no
checking whether to build with libidn2... (assumed) yes
checking for pkg-config... (cached) /usr/bin/pkg-config
checking for libidn2 options with pkg-config... no
configure: IDN_LIBS: "-lidn2"
configure: IDN_LDFLAGS: ""
configure: IDN_CPPFLAGS: ""
configure: IDN_DIR: ""
checking if idn2_lookup_ul can be linked... no
checking for idn2.h... no
checking for pkg-config... (cached) /usr/bin/pkg-config
checking for libnghttp2 options with pkg-config... no
checking for nghttp2_session_get_stream_local_window_size in -lnghttp2... no
checking for sys/types.h... (cached) yes
checking for sys/time.h... (cached) yes
checking for sys/select.h... yes
checking for sys/socket.h... yes
checking for sys/ioctl.h... yes
checking for unistd.h... (cached) yes
checking for stdlib.h... (cached) yes
checking for arpa/inet.h... yes
checking for net/if.h... yes
checking for netinet/in.h... yes
checking for netinet/in6.h... no
checking for sys/un.h... yes
checking for linux/tcp.h... yes
checking for netinet/tcp.h... yes
checking for netinet/udp.h... yes
checking for netdb.h... yes
checking for sys/sockio.h... no
checking for sys/stat.h... (cached) yes
checking for sys/param.h... yes
checking for termios.h... yes
checking for termio.h... yes
checking for fcntl.h... yes
checking for io.h... no
checking for pwd.h... yes
checking for utime.h... yes
checking for sys/utime.h... no
checking for sys/poll.h... yes
checking for poll.h... yes
checking for sys/resource.h... yes
checking for libgen.h... yes
checking for locale.h... yes
checking for stdbool.h... yes
checking for sys/filio.h... no
checking for sys/wait.h... yes
checking for sys/eventfd.h... yes
checking for setjmp.h... yes
checking for an ANSI C-conforming const... yes
checking for size_t... yes
checking for sys/types.h... (cached) yes
checking for sys/time.h... (cached) yes
checking for sys/socket.h... (cached) yes
checking for struct timeval... yes
checking run-time libs availability... fine
checking size of size_t... 8
checking size of long... 8
checking size of int... 4
checking size of time_t... 8
checking size of off_t... 8
checking size of curl_off_t... 8
checking size of curl_socket_t... 4
checking for long long... yes
checking for ssize_t... yes
checking for bool... yes
checking for sa_family_t... yes
checking for suseconds_t... yes
checking if time_t is unsigned... no
checking for in_addr_t... yes
checking for struct sockaddr_storage... yes
checking for sys/select.h... (cached) yes
checking for sys/socket.h... (cached) yes
checking for select... yes
checking for sys/types.h... (cached) yes
checking for sys/socket.h... (cached) yes
checking for recv... yes
checking for sys/types.h... (cached) yes
checking for sys/socket.h... (cached) yes
checking for send... yes
checking for sys/types.h... (cached) yes
checking for sys/socket.h... (cached) yes
checking for MSG_NOSIGNAL... yes
checking for sys/types.h... (cached) yes
checking for unistd.h... (cached) yes
checking if alarm can be linked... yes
checking if alarm is prototyped... yes
checking if alarm is compilable... yes
checking if alarm usage allowed... yes
checking if alarm might be used... yes
checking for sys/types.h... (cached) yes
checking for strings.h... (cached) yes
checking for sys/types.h... (cached) yes
checking for libgen.h... (cached) yes
checking if basename can be linked... yes
checking if basename is prototyped... yes
checking if basename is compilable... yes
checking if basename usage allowed... yes
checking if basename might be used... yes
checking if closesocket can be linked... no
checking if closesocket might be used... no
checking for sys/types.h... (cached) yes
checking for sys/socket.h... (cached) yes
checking if CloseSocket can be linked... no
checking if CloseSocket might be used... no
checking for sys/types.h... (cached) yes
checking for unistd.h... (cached) yes
checking for fcntl.h... (cached) yes
checking if fcntl can be linked... yes
checking if fcntl is prototyped... yes
checking if fcntl is compilable... yes
checking if fcntl usage allowed... yes
checking if fcntl might be used... yes
checking if fcntl O_NONBLOCK is compilable... yes
checking if fcntl O_NONBLOCK usage allowed... yes
checking if fcntl O_NONBLOCK might be used... yes
checking whether build target is a native Windows one... (cached) no
checking for sys/types.h... (cached) yes
checking for netdb.h... (cached) yes
checking if freeaddrinfo can be linked... yes
checking if freeaddrinfo is prototyped... yes
checking if freeaddrinfo is compilable... yes
checking if freeaddrinfo usage allowed... yes
checking if freeaddrinfo might be used... yes
checking for sys/types.h... (cached) yes
checking for sys/xattr.h... yes
checking if fsetxattr can be linked... yes
checking if fsetxattr is prototyped... yes
checking if fsetxattr takes 5 args.... yes
checking if fsetxattr is compilable... yes
checking if fsetxattr usage allowed... yes
checking if fsetxattr might be used... yes
checking if ftruncate can be linked... yes
checking if ftruncate is prototyped... yes
checking if ftruncate is compilable... yes
checking if ftruncate usage allowed... yes
checking if ftruncate might be used... yes
checking for sys/types.h... (cached) yes
checking if getaddrinfo can be linked... yes
checking if getaddrinfo is prototyped... yes
checking if getaddrinfo is compilable... yes
checking if getaddrinfo seems to work... yes
checking if getaddrinfo usage allowed... yes
checking if getaddrinfo might be used... yes
checking if getaddrinfo is threadsafe... yes
checking if gethostbyname can be linked... yes
checking if gethostbyname is prototyped... yes
checking if gethostbyname is compilable... yes
checking if gethostbyname usage allowed... yes
checking if gethostbyname might be used... yes
checking if gethostbyname_r can be linked... yes
checking if gethostbyname_r is prototyped... yes
checking if gethostbyname_r takes 3 args.... no
checking if gethostbyname_r takes 5 args.... no
checking if gethostbyname_r takes 6 args.... yes
checking if gethostbyname_r is compilable... yes
checking if gethostbyname_r usage allowed... yes
checking if gethostbyname_r might be used... yes
checking if gethostname can be linked... yes
checking if gethostname is prototyped... yes
checking if gethostname is compilable... yes
checking for gethostname arg 2 data type... size_t
checking if gethostname usage allowed... yes
checking if gethostname might be used... yes
checking if getpeername can be linked... yes
checking if getpeername is prototyped... yes
checking if getpeername is compilable... yes
checking if getpeername usage allowed... yes
checking if getpeername might be used... yes
checking if getsockname can be linked... yes
checking if getsockname is prototyped... yes
checking if getsockname is compilable... yes
checking if getsockname usage allowed... yes
checking if getsockname might be used... yes
checking for sys/types.h... (cached) yes
checking for sys/socket.h... (cached) yes
checking for netinet/in.h... (cached) yes
checking for ifaddrs.h... yes
checking if getifaddrs can be linked... yes
checking if getifaddrs is prototyped... yes
checking if getifaddrs is compilable... yes
checking if getifaddrs seems to work... yes
checking if getifaddrs usage allowed... yes
checking if getifaddrs might be used... yes
checking for sys/types.h... (cached) yes
checking for sys/time.h... (cached) yes
checking if gmtime_r can be linked... yes
checking if gmtime_r is prototyped... yes
checking if gmtime_r is compilable... yes
checking if gmtime_r seems to work... yes
checking if gmtime_r usage allowed... yes
checking if gmtime_r might be used... yes
checking for sys/types.h... (cached) yes
checking for sys/socket.h... (cached) yes
checking for netinet/in.h... (cached) yes
checking for arpa/inet.h... (cached) yes
checking if inet_ntop can be linked... yes
checking if inet_ntop is prototyped... yes
checking if inet_ntop is compilable... yes
checking if inet_ntop seems to work... yes
checking if inet_ntop usage allowed... yes
checking if inet_ntop might be used... yes
checking if inet_pton can be linked... yes
checking if inet_pton is prototyped... yes
checking if inet_pton is compilable... yes
checking if inet_pton seems to work... yes
checking if inet_pton usage allowed... yes
checking if inet_pton might be used... yes
checking for sys/types.h... (cached) yes
checking for unistd.h... (cached) yes
checking for sys/socket.h... (cached) yes
checking for sys/ioctl.h... (cached) yes
checking for stropts.h... no
checking if ioctl can be linked... yes
checking if ioctl is prototyped... yes
checking if ioctl is compilable... yes
checking if ioctl usage allowed... yes
checking if ioctl might be used... yes
checking if ioctl FIONBIO is compilable... yes
checking if ioctl FIONBIO usage allowed... yes
checking if ioctl FIONBIO might be used... yes
checking if ioctl SIOCGIFADDR is compilable... yes
checking if ioctl SIOCGIFADDR usage allowed... yes
checking if ioctl SIOCGIFADDR might be used... yes
checking if ioctlsocket can be linked... no
checking if ioctlsocket might be used... no
checking if IoctlSocket can be linked... no
checking if IoctlSocket might be used... no
checking if memrchr can be linked... yes
checking if memrchr is prototyped... yes
checking if memrchr is compilable... yes
checking if memrchr usage allowed... yes
checking if memrchr might be used... yes
checking for sys/types.h... (cached) yes
checking if sigaction can be linked... yes
checking if sigaction is prototyped... yes
checking if sigaction is compilable... yes
checking if sigaction usage allowed... yes
checking if sigaction might be used... yes
checking if siginterrupt can be linked... yes
checking if siginterrupt is prototyped... yes
checking if siginterrupt is compilable... yes
checking if siginterrupt usage allowed... yes
checking if siginterrupt might be used... yes
checking if signal can be linked... yes
checking if signal is prototyped... yes
checking if signal is compilable... yes
checking if signal usage allowed... yes
checking if signal might be used... yes
checking for sys/types.h... (cached) yes
checking if sigsetjmp can be linked... no
checking if sigsetjmp seems a macro... yes
checking if sigsetjmp is compilable... yes
checking if sigsetjmp usage allowed... yes
checking if sigsetjmp might be used... yes
checking if socket can be linked... yes
checking if socket is prototyped... yes
checking if socket is compilable... yes
checking if socket usage allowed... yes
checking if socket might be used... yes
checking if socketpair can be linked... yes
checking if socketpair is prototyped... yes
checking if socketpair is compilable... yes
checking if socketpair usage allowed... yes
checking if socketpair might be used... yes
checking if strcasecmp can be linked... yes
checking if strcasecmp is prototyped... yes
checking if strcasecmp is compilable... yes
checking if strcasecmp usage allowed... yes
checking if strcasecmp might be used... yes
checking if strcmpi can be linked... no
checking if strcmpi might be used... no
checking if strdup can be linked... yes
checking if strdup is prototyped... yes
checking if strdup is compilable... yes
checking if strdup usage allowed... yes
checking if strdup might be used... yes
checking if strerror_r can be linked... yes
checking if strerror_r is prototyped... yes
checking if strerror_r is compilable... yes
checking if strerror_r is glibc like... yes
checking if strerror_r seems to work... yes
checking if strerror_r usage allowed... yes
checking if strerror_r might be used... yes
checking if stricmp can be linked... no
checking if stricmp might be used... no
checking if strtok_r can be linked... yes
checking if strtok_r is prototyped... yes
checking if strtok_r is compilable... yes
checking if strtok_r usage allowed... yes
checking if strtok_r might be used... yes
checking if strtoll can be linked... yes
checking if strtoll is prototyped... yes
checking if strtoll is compilable... yes
checking if strtoll usage allowed... yes
checking if strtoll might be used... yes
checking for ccache gcc options needed to detect all undeclared functions... none needed
checking whether getpwuid_r is declared... yes
checking for _fseeki64... no
checking for eventfd... yes
checking for fnmatch... yes
checking for geteuid... yes
checking for getpass_r... no
checking for getppid... yes
checking for getpwuid... yes
checking for getpwuid_r... yes
checking for getrlimit... yes
checking for gettimeofday... yes
checking for if_nametoindex... yes
checking for mach_absolute_time... no
checking for pipe... yes
checking for poll... yes
checking for sched_yield... yes
checking for sendmsg... yes
checking for sendmmsg... yes
checking for setlocale... yes
checking for setmode... no
checking for setrlimit... yes
checking for snprintf... yes
checking for utime... yes
checking for utimes... yes
checking for arc4random... no
checking for fseeko... yes
checking whether fseeko is declared... yes
checking how to set a socket into non-blocking mode... fcntl O_NONBLOCK
checking whether to enable the threaded resolver... yes
checking whether to link macOS CoreFoundation, CoreServices, and SystemConfiguration frameworks... no
checking whether to use POSIX threads for threaded resolver... auto
checking for pthread.h... yes
checking for pthread_create... yes
checking for dirent.h... yes
checking for opendir... yes
checking convert -I options to -isystem... yes
checking whether to enable verbose strings... yes
checking whether to enable SSPI support (Windows native builds only)... no
checking whether to enable basic authentication method... yes
checking whether to enable bearer authentication method... yes
checking whether to enable digest authentication method... yes
checking whether to enable kerberos authentication method... yes
checking whether to enable negotiate authentication method... yes
checking whether to enable aws sig methods... yes
checking whether to support NTLM... yes
checking whether to enable TLS-SRP authentication... yes
checking whether to enable Unix domain sockets... auto
checking for struct sockaddr_un.sun_path... yes
checking whether to support cookies... yes
checking whether to support socketpair... yes
checking whether to support HTTP authentication... yes
checking whether to support DoH... yes
checking whether to support the MIME API... yes
checking whether to support binding connections locally... yes
checking whether to support the form API... yes
checking whether to support date parsing... yes
checking whether to support netrc parsing... yes
checking whether to support progress-meter... yes
checking whether to support the SHA-512/256 hash algorithm... yes
checking whether to support DNS shuffling... yes
checking whether to support curl_easy_option*... yes
checking whether to support alt-svc... yes
checking whether to support headers-api... yes
configure: disables HSTS due to lack of SSL
checking whether to support WebSockets... yes
checking whether hiding of library internal symbols will actually happen... yes
checking if this build supports HTTPS-proxy... no
checking that generated files are newer than configure... done
configure: creating ./config.status
config.status: creating Makefile
config.status: creating docs/Makefile
config.status: creating docs/examples/Makefile
config.status: creating docs/libcurl/Makefile
config.status: creating docs/libcurl/opts/Makefile
config.status: creating docs/cmdline-opts/Makefile
config.status: creating include/Makefile
config.status: creating include/curl/Makefile
config.status: creating src/Makefile
config.status: creating lib/Makefile
config.status: creating scripts/Makefile
config.status: creating lib/libcurl.vers
config.status: creating tests/Makefile
config.status: creating tests/config
config.status: creating tests/configurehelp.pm
config.status: creating tests/certs/Makefile
config.status: creating tests/certs/scripts/Makefile
config.status: creating tests/data/Makefile
config.status: creating tests/server/Makefile
config.status: creating tests/libtest/Makefile
config.status: creating tests/unit/Makefile
config.status: creating tests/http/config.ini
config.status: creating tests/http/Makefile
config.status: creating tests/http/clients/Makefile
config.status: creating packages/Makefile
config.status: creating packages/vms/Makefile
config.status: creating curl-config
config.status: creating libcurl.pc
config.status: creating lib/curl_config.h
config.status: executing depfiles commands
config.status: executing libtool commands
configure: Configured to build curl/libcurl:

Host setup: x86_64-pc-linux-gnu
Install prefix: /usr/local
Compiler: ccache gcc
CFLAGS: -Werror-implicit-function-declaration -O2 -Wno-system-headers
CFLAGS extras:
CPPFLAGS: -D_GNU_SOURCE
LDFLAGS:
LIBS: -lpsl -lz

curl version: 8.11.0-DEV
SSL: no (--with-{openssl,gnutls,mbedtls,wolfssl,schannel,secure-transport,amissl,bearssl,rustls} )
SSH: no (--with-{libssh,libssh2})
zlib: enabled
brotli: no (--with-brotli)
zstd: no (--with-zstd)
GSS-API: no (--with-gssapi)
GSASL: no (libgsasl not found)
TLS-SRP: no (--enable-tls-srp)
resolver: POSIX threaded
IPv6: enabled
Unix sockets: enabled
IDN: no (--with-{libidn2,winidn})
Build docs: no
Build libcurl: Shared=no, Static=yes
Built-in manual: no (--enable-manual)
--libcurl option: enabled (--disable-libcurl-option)
Verbose errors: enabled (--disable-verbose)
Code coverage: disabled
SSPI: no (--enable-sspi)
ca cert bundle: no
ca cert path:
ca cert embed: no
ca fallback:
LDAP: no (--enable-ldap / --with-ldap-lib / --with-lber-lib)
LDAPS: no (--enable-ldaps)
IPFS/IPNS: enabled
RTSP: enabled
RTMP: no (--with-librtmp)
PSL: enabled
Alt-svc: enabled (--disable-alt-svc)
Headers API: enabled (--disable-headers-api)
HSTS: no (--enable-hsts)
HTTP1: enabled (internal)
HTTP2: no (--with-nghttp2)
HTTP3: no (--with-ngtcp2 --with-nghttp3, --with-quiche, --with-openssl-quic, --with-msh3)
ECH: no (--enable-ech)
Protocols: dict file ftp gopher http imap ipfs ipns mqtt pop3 rtsp smtp telnet tftp ws
Features: alt-svc AsynchDNS IPv6 Largefile libz PSL threadsafe UnixSockets

configure: WARNING: Cannot find libraries for LDAP support: LDAP disabled
configure: WARNING: libgsasl was not found
configure: WARNING: Cannot find libidn2

$ make -j3
Making all in lib
make[1]: Entering directory '/root/asi_db/builds/curl/_worktrees/w0/lib'
make all-am
make[2]: Entering directory '/root/asi_db/builds/curl/_worktrees/w0/lib'
CC libcurl_la-altsvc.lo
CC libcurl_la-amigaos.lo
CC libcurl_la-asyn-ares.lo
CC libcurl_la-asyn-thread.lo
CC libcurl_la-base64.lo
CC libcurl_la-bufq.lo
CC libcurl_la-bufref.lo
CC libcurl_la-c-hyper.lo
CC libcurl_la-cf-h1-proxy.lo
CC libcurl_la-cf-h2-proxy.lo
CC libcurl_la-cf-haproxy.lo
CC libcurl_la-cf-https-connect.lo
CC libcurl_la-cf-socket.lo
CC libcurl_la-cfilters.lo
CC libcurl_la-conncache.lo
CC libcurl_la-connect.lo
CC libcurl_la-content_encoding.lo
CC libcurl_la-cookie.lo
CC libcurl_la-curl_addrinfo.lo
CC libcurl_la-curl_des.lo
CC libcurl_la-curl_endian.lo
CC libcurl_la-curl_fnmatch.lo
CC libcurl_la-curl_get_line.lo
CC libcurl_la-curl_gethostname.lo
CC libcurl_la-curl_gssapi.lo
CC libcurl_la-curl_memrchr.lo
CC libcurl_la-curl_multibyte.lo
CC libcurl_la-curl_ntlm_core.lo
CC libcurl_la-curl_path.lo
CC libcurl_la-curl_range.lo
CC libcurl_la-curl_rtmp.lo
CC libcurl_la-curl_sasl.lo
CC libcurl_la-curl_sha512_256.lo
CC libcurl_la-curl_sspi.lo
CC libcurl_la-curl_threads.lo
CC libcurl_la-curl_trc.lo
CC libcurl_la-cw-out.lo
CC libcurl_la-dict.lo
CC libcurl_la-dllmain.lo
CC libcurl_la-doh.lo
CC libcurl_la-dynbuf.lo
CC libcurl_la-dynhds.lo
CC libcurl_la-easy.lo
CC libcurl_la-easygetopt.lo
CC libcurl_la-easyoptions.lo
CC libcurl_la-escape.lo
CC libcurl_la-file.lo
CC libcurl_la-fileinfo.lo
CC libcurl_la-fopen.lo
CC libcurl_la-formdata.lo
CC libcurl_la-ftp.lo
CC libcurl_la-ftplistparser.lo
CC libcurl_la-getenv.lo
CC libcurl_la-getinfo.lo
CC libcurl_la-gopher.lo
CC libcurl_la-hash.lo
CC libcurl_la-headers.lo
CC libcurl_la-hmac.lo
CC libcurl_la-hostasyn.lo
CC libcurl_la-hostip.lo
CC libcurl_la-hostip4.lo
CC libcurl_la-hostip6.lo
CC libcurl_la-hostsyn.lo
CC libcurl_la-hsts.lo
CC libcurl_la-http.lo
CC libcurl_la-http1.lo
CC libcurl_la-http2.lo
CC libcurl_la-http_aws_sigv4.lo
CC libcurl_la-http_chunks.lo
CC libcurl_la-http_digest.lo
CC libcurl_la-http_negotiate.lo
CC libcurl_la-http_ntlm.lo
CC libcurl_la-http_proxy.lo
CC libcurl_la-idn.lo
CC libcurl_la-if2ip.lo
CC libcurl_la-imap.lo
CC libcurl_la-inet_ntop.lo
CC libcurl_la-inet_pton.lo
CC libcurl_la-krb5.lo
CC libcurl_la-ldap.lo
CC libcurl_la-llist.lo
CC libcurl_la-macos.lo
CC libcurl_la-md4.lo
CC libcurl_la-md5.lo
CC libcurl_la-memdebug.lo
CC libcurl_la-mime.lo
CC libcurl_la-mprintf.lo
CC libcurl_la-mqtt.lo
CC libcurl_la-multi.lo
CC libcurl_la-netrc.lo
CC libcurl_la-nonblock.lo
CC libcurl_la-noproxy.lo
CC libcurl_la-openldap.lo
CC libcurl_la-parsedate.lo
CC libcurl_la-pingpong.lo
CC libcurl_la-pop3.lo
CC libcurl_la-progress.lo
CC libcurl_la-psl.lo
CC libcurl_la-rand.lo
CC libcurl_la-rename.lo
CC libcurl_la-request.lo
CC libcurl_la-rtsp.lo
CC libcurl_la-select.lo
CC libcurl_la-sendf.lo
CC libcurl_la-setopt.lo
CC libcurl_la-sha256.lo
CC libcurl_la-share.lo
CC libcurl_la-slist.lo
CC libcurl_la-smb.lo
CC libcurl_la-smtp.lo
CC libcurl_la-socketpair.lo
CC libcurl_la-socks.lo
CC libcurl_la-socks_gssapi.lo
CC libcurl_la-socks_sspi.lo
CC libcurl_la-speedcheck.lo
CC libcurl_la-splay.lo
CC libcurl_la-strcase.lo
CC libcurl_la-strdup.lo
CC libcurl_la-strerror.lo
CC libcurl_la-strtok.lo
CC libcurl_la-strtoofft.lo
CC libcurl_la-system_win32.lo
CC libcurl_la-telnet.lo
CC libcurl_la-tftp.lo
CC libcurl_la-timediff.lo
CC libcurl_la-timeval.lo
CC libcurl_la-transfer.lo
CC libcurl_la-url.lo
CC libcurl_la-urlapi.lo
CC libcurl_la-version.lo
CC libcurl_la-version_win32.lo
CC libcurl_la-warnless.lo
CC libcurl_la-ws.lo
CC vauth/libcurl_la-cleartext.lo
CC vauth/libcurl_la-cram.lo
CC vauth/libcurl_la-digest.lo
CC vauth/libcurl_la-digest_sspi.lo
CC vauth/libcurl_la-gsasl.lo
CC vauth/libcurl_la-krb5_gssapi.lo
CC vauth/libcurl_la-krb5_sspi.lo
CC vauth/libcurl_la-ntlm.lo
CC vauth/libcurl_la-ntlm_sspi.lo
CC vauth/libcurl_la-oauth2.lo
CC vauth/libcurl_la-spnego_gssapi.lo
CC vauth/libcurl_la-spnego_sspi.lo
CC vauth/libcurl_la-vauth.lo
CC vtls/libcurl_la-bearssl.lo
CC vtls/libcurl_la-cipher_suite.lo
CC vtls/libcurl_la-gtls.lo
CC vtls/libcurl_la-hostcheck.lo
CC vtls/libcurl_la-keylog.lo
CC vtls/libcurl_la-mbedtls.lo
CC vtls/libcurl_la-mbedtls_threadlock.lo
CC vtls/libcurl_la-openssl.lo
CC vtls/libcurl_la-rustls.lo
CC vtls/libcurl_la-schannel.lo
CC vtls/libcurl_la-schannel_verify.lo
CC vtls/libcurl_la-sectransp.lo
CC vtls/libcurl_la-vtls.lo
CC vtls/libcurl_la-wolfssl.lo
CC vtls/libcurl_la-x509asn1.lo
CC vquic/libcurl_la-curl_msh3.lo
CC vquic/libcurl_la-curl_ngtcp2.lo
CC vquic/libcurl_la-curl_osslq.lo
CC vquic/libcurl_la-curl_quiche.lo
CC vquic/libcurl_la-vquic.lo
CC vquic/libcurl_la-vquic-tls.lo
CC vssh/libcurl_la-libssh.lo
CC vssh/libcurl_la-libssh2.lo
CC vssh/libcurl_la-wolfssh.lo
CCLD libcurl.la
make[2]: Leaving directory '/root/asi_db/builds/curl/_worktrees/w0/lib'
make[1]: Leaving directory '/root/asi_db/builds/curl/_worktrees/w0/lib'
Making all in docs
make[1]: Entering directory '/root/asi_db/builds/curl/_worktrees/w0/docs'
Making all in .
make[2]: Entering directory '/root/asi_db/builds/curl/_worktrees/w0/docs'
make[2]: Nothing to be done for 'all-am'.
make[2]: Leaving directory '/root/asi_db/builds/curl/_worktrees/w0/docs'
Making all in cmdline-opts
make[2]: Entering directory '/root/asi_db/builds/curl/_worktrees/w0/docs/cmdline-opts'
make[2]: Nothing to be done for 'all'.
make[2]: Leaving directory '/root/asi_db/builds/curl/_worktrees/w0/docs/cmdline-opts'
Making all in libcurl
make[2]: Entering directory '/root/asi_db/builds/curl/_worktrees/w0/docs/libcurl'
Making all in opts
make[3]: Entering directory '/root/asi_db/builds/curl/_worktrees/w0/docs/libcurl/opts'
make[3]: Nothing to be done for 'all'.
make[3]: Leaving directory '/root/asi_db/builds/curl/_worktrees/w0/docs/libcurl/opts'
make[3]: Entering directory '/root/asi_db/builds/curl/_worktrees/w0/docs/libcurl'
make[3]: Nothing to be done for 'all-am'.
make[3]: Leaving directory '/root/asi_db/builds/curl/_worktrees/w0/docs/libcurl'
make[2]: Leaving directory '/root/asi_db/builds/curl/_worktrees/w0/docs/libcurl'
make[1]: Leaving directory '/root/asi_db/builds/curl/_worktrees/w0/docs'
Making all in src
make[1]: Entering directory '/root/asi_db/builds/curl/_worktrees/w0/src'
CC slist_wc.o
CC terminal.o
CC tool_binmode.o
CC tool_cb_dbg.o
CC tool_bname.o
CC tool_cb_hdr.o
CC tool_cb_prg.o
CC tool_cb_rea.o
CC tool_cb_see.o
CC tool_cb_soc.o
CC tool_cb_wrt.o
CC tool_cfgable.o
CC tool_dirhie.o
CC tool_doswin.o
CC tool_easysrc.o
CC tool_filetime.o
CC tool_findfile.o
CC tool_formparse.o
CC tool_getparam.o
CC tool_getpass.o
CC tool_help.o
echo '#include "tool_hugehelp.h"' >> tool_hugehelp.c
CC tool_helpers.o
CC tool_ipfs.o
CC tool_libinfo.o
CC tool_listhelp.o
CC tool_main.o
CC tool_msgs.o
CC tool_operhlp.o
CC tool_operate.o
CC tool_paramhlp.o
CC tool_parsecfg.o
CC tool_progress.o
CC tool_setopt.o
CC tool_sleep.o
CC tool_stderr.o
CC tool_strdup.o
CC tool_urlglob.o
CC tool_util.o
CC tool_vms.o
CC tool_writeout.o
CC tool_writeout_json.o
CC tool_xattr.o
echo 'extern const void *curl_ca_embed; const void *curl_ca_embed;' > tool_ca_embed.c
CC var.o
CC tool_hugehelp.o
CC tool_ca_embed.o
CC ../lib/base64.o
CC ../lib/curl_multibyte.o
CC ../lib/dynbuf.o
CC ../lib/nonblock.o
CC ../lib/strtoofft.o
CC ../lib/timediff.o
CC ../lib/version_win32.o
CC ../lib/warnless.o
CCLD curl
make[1]: Leaving directory '/root/asi_db/builds/curl/_worktrees/w0/src'
Making all in scripts
make[1]: Entering directory '/root/asi_db/builds/curl/_worktrees/w0/scripts'
make[1]: Nothing to be done for 'all'.
make[1]: Leaving directory '/root/asi_db/builds/curl/_worktrees/w0/scripts'
make[1]: Entering directory '/root/asi_db/builds/curl/_worktrees/w0'
make[1]: Nothing to be done for 'all-am'.
make[1]: Leaving directory '/root/asi_db/builds/curl/_worktrees/w0'

Commit Diff GitHub →

docs/cmdline-opts/Makefile.inc +1 -0 docs/cmdline-opts/tls-earlydata.md +41 -0 docs/libcurl/curl_easy_getinfo.md +5 -0 docs/libcurl/opts/CURLINFO_EARLYDATA_SENT_T.md +75 -0 docs/libcurl/opts/CURLOPT_SSL_OPTIONS.md +9 -0 docs/libcurl/opts/Makefile.inc +1 -0 docs/libcurl/symbols-in-versions +2 -0 docs/options-in-versions +1 -0 include/curl/curl.h +5 -1 lib/cf-https-connect.c +10 -3 lib/getinfo.c +3 -0 lib/http2.c +17 -5 lib/progress.c +5 -0 lib/progress.h +2 -0 lib/setopt.c +1 -0 lib/urldata.h +3 -0 lib/vtls/bearssl.c +4 -3 lib/vtls/gtls.c +296 -72 lib/vtls/mbedtls.c +4 -3 lib/vtls/openssl.c +4 -4 lib/vtls/rustls.c +2 -1 lib/vtls/schannel.c +5 -4 lib/vtls/sectransp.c +4 -3 lib/vtls/vtls.c +86 -6 lib/vtls/vtls.h +8 -5 lib/vtls/vtls_int.h +35 -1 lib/vtls/wolfssl.c +5 -5 src/tool_cfgable.h +1 -0 src/tool_getparam.c +5 -0 src/tool_getparam.h +1 -0 src/tool_listhelp.c +3 -0 src/tool_operate.c +2 -0 tests/http/clients/hx-download.c +51 -7 tests/http/clients/hx-upload.c +54 -5 tests/http/test_02_download.py +46 -0 tests/http/test_07_upload.py +47 -0 tests/http/test_08_caddy.py +45 -1 tests/http/test_17_ssl_use.py +3 -4 tests/http/testenv/env.py +5 -0 tests/http/testenv/nghttpx.py +1 -0

docs/cmdline-opts/Makefile.inc+1 -0

@@ -281,6 +281,7 @@ DPAGES = \
	tftp-blksize.md \
	tftp-no-options.md \
	time-cond.md \
+	tls-earlydata.md \
	tls-max.md \
	tls13-ciphers.md \
	tlsauthtype.md \

docs/cmdline-opts/tls-earlydata.md+41 -0

@@ -0,0 +1,41 @@
+	---
+	c: Copyright (C) Daniel Stenberg, <[email protected]>, et al.
+	SPDX-License-Identifier: curl
+	Long: tls-earlydata
+	Help: Allow use of TLSv1.3 early data (0RTT)
+	Protocols: TLS
+	Added: 8.11.0
+	Category: tls
+	Multi: boolean
+	See-also:
+	- tlsv1.3
+	- tls-max
+	Example:
+	- --tls-earlydata $URL
+	---
+
+	# `--tls-earlydata`
+
+	Enable the use of TLSv1.3 early data, also known as '0RTT' where possible.
+	This has security implications for the requests sent that way.
+
+	This option is used when curl is built to use GnuTLS.
+
+	If a server supports this TLSv1.3 feature, and to what extent, is announced
+	as part of the TLS "session" sent back to curl. Until curl has seen such
+	a session in a previous request, early data cannot be used.
+
+	When a new connection is initiated with a known TLSv1.3 session, and that
+	session announced early data support, the first request on this connection is
+	sent before the TLS handshake is complete. While the early data is also
+	encrypted, it is not protected against replays. An attacker can send
+	your early data to the server again and the server would accept it.
+
+	If your request contacts a public server and only retrieves a file, there
+	may be no harm in that. If the first request orders a refrigerator
+	for you, it is probably not a good idea to use early data for it. curl
+	cannot deduce what the security implications of your requests actually
+	are and make this decision for you.
+
+	WARNING: this option has security implications. See above for more
+	details.

docs/libcurl/curl_easy_getinfo.md+5 -0

@@ -112,6 +112,11 @@ curl_easy_header(3) instead. See CURLINFO_CONTENT_TYPE(3)

	List of all known cookies. See CURLINFO_COOKIELIST(3)

+	## CURLINFO_EARLYDATA_SENT_T
+
+	Amount of TLS early data sent (in number of bytes) when
+	CURLSSLOPT_EARLYDATA is enabled.
+
	## CURLINFO_EFFECTIVE_METHOD

	Last used HTTP method. See CURLINFO_EFFECTIVE_METHOD(3)

docs/libcurl/opts/CURLINFO_EARLYDATA_SENT_T.md+75 -0

@@ -0,0 +1,75 @@
+	---
+	c: Copyright (C) Daniel Stenberg, <[email protected]>, et al.
+	SPDX-License-Identifier: curl
+	Title: CURLINFO_EARLYDATA_SENT_T
+	Section: 3
+	Source: libcurl
+	See-also:
+	- curl_easy_getinfo (3)
+	- curl_easy_setopt (3)
+	Protocol:
+	- TLS
+	TLS-backend:
+	- GnuTLS
+	Added-in: 8.11.0
+	---
+
+	# NAME
+
+	CURLINFO_EARLYDATA_SENT_T - get the number of bytes sent as TLS early data
+
+	# SYNOPSIS
+
+	~~~c
+	#include <curl/curl.h>
+
+	CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_EARLYDATA_SENT_T,
+	curl_off_t *amount);
+	~~~
+
+	# DESCRIPTION
+
+	Pass a pointer to an curl_off_t to receive the total amount of bytes that
+	were sent to the server as TLSv1.3 early data. When no TLS early
+	data is used, this reports 0.
+
+	TLS early data is only attempted when CURLSSLOPT_EARLYDATA is set for the
+	transfer. In addition, it is only used by libcurl when a TLS session exists
+	that announces support.
+
+	The amount is negative when the sent data was rejected
+	by the server. TLS allows a server that announces support for early data to
+	reject any attempt to use it at its own discretion. When for example 127
+	bytes had been sent, but were rejected, it reports -127 as the amount "sent".
+
+	# %PROTOCOLS%
+
+	# EXAMPLE
+
+	~~~c
+	int main(void)
+	{
+	CURL *curl = curl_easy_init();
+	if(curl) {
+	CURLcode res;
+	curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+
+	/* Perform the request */
+	res = curl_easy_perform(curl);
+
+	if(!res) {
+	curl_off_t amount;
+	res = curl_easy_getinfo(curl, CURLINFO_EARLYDATA_SENT_T, &amount);
+	if(!res) {
+	printf("TLS earlydata: %" CURL_FORMAT_CURL_OFF_T " bytes\n", amount);
+	}
+	}
+	}
+	}
+	~~~
+
+	# %AVAILABILITY%
+
+	# RETURN VALUE
+
+	Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.

docs/libcurl/opts/CURLOPT_SSL_OPTIONS.md+9 -0

@@ -86,6 +86,15 @@ certificate that supports client authentication in the OS certificate store it
	could be a privacy violation and unexpected.
	(Added in 7.77.0)

+	## CURLSSLOPT_EARLYDATA
+
+	Tell libcurl to try sending application data as TLS1.3 early data. This option
+	is only supported for GnuTLS. This option works on a best effort basis,
+	in cases when it wasn't possible to send early data the request is resent
+	normally post-handshake.
+	This option does not work when using QUIC.
+	(Added in 8.11.0)
+
	# DEFAULT

	0

docs/libcurl/opts/Makefile.inc+1 -0

@@ -167,6 +167,7 @@ man_MANS = \
	CURLOPT_DOH_SSL_VERIFYPEER.3 \
	CURLOPT_DOH_SSL_VERIFYSTATUS.3 \
	CURLOPT_DOH_URL.3 \
+	CURLINFO_EARLYDATA_SENT_T.3 \
	CURLOPT_ECH.3 \
	CURLOPT_EGDSOCKET.3 \
	CURLOPT_ERRORBUFFER.3 \

docs/libcurl/symbols-in-versions+2 -0

@@ -435,6 +435,7 @@ CURLINFO_COOKIELIST 7.14.1
	CURLINFO_DATA_IN 7.9.6
	CURLINFO_DATA_OUT 7.9.6
	CURLINFO_DOUBLE 7.4.1
+	CURLINFO_EARLYDATA_SENT_T 8.11.0
	CURLINFO_EFFECTIVE_METHOD 7.72.0
	CURLINFO_EFFECTIVE_URL 7.4
	CURLINFO_END 7.9.6
@@ -1054,6 +1055,7 @@ CURLSSLOPT_NATIVE_CA 7.71.0
	CURLSSLOPT_NO_PARTIALCHAIN 7.68.0
	CURLSSLOPT_NO_REVOKE 7.44.0
	CURLSSLOPT_REVOKE_BEST_EFFORT 7.70.0
+	CURLSSLOPT_EARLYDATA 8.11.0
	CURLSSLSET_NO_BACKENDS 7.56.0
	CURLSSLSET_OK 7.56.0
	CURLSSLSET_TOO_LATE 7.56.0

docs/options-in-versions+1 -0

@@ -246,6 +246,7 @@
	--tftp-blksize 7.20.0
	--tftp-no-options 7.48.0
	--time-cond (-z) 5.8
+	--tls-earlydata 8.11.0
	--tls-max 7.54.0
	--tls13-ciphers 7.61.0
	--tlsauthtype 7.21.4

include/curl/curl.h+5 -1

@@ -943,6 +943,9 @@ typedef enum {
	a client certificate for authentication. (Schannel) */
	#define CURLSSLOPT_AUTO_CLIENT_CERT (1<<5)

+	/* If possible, send data using TLS 1.3 early data */
+	#define CURLSSLOPT_EARLYDATA (1<<6)
+
	/* The default connection attempt delay in milliseconds for happy eyeballs.
	CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS.3 and happy-eyeballs-timeout-ms.d document
	this value, keep them in sync. */
@@ -2954,7 +2957,8 @@ typedef enum {
	CURLINFO_QUEUE_TIME_T = CURLINFO_OFF_T + 65,
	CURLINFO_USED_PROXY = CURLINFO_LONG + 66,
	CURLINFO_POSTTRANSFER_TIME_T = CURLINFO_OFF_T + 67,
-	CURLINFO_LASTONE = 67
+	CURLINFO_EARLYDATA_SENT_T = CURLINFO_OFF_T + 68,
+	CURLINFO_LASTONE = 68
	} CURLINFO;

	/* CURLINFO_RESPONSE_CODE is the new name for the option previously known as

lib/cf-https-connect.c+10 -3

@@ -174,6 +174,7 @@ static CURLcode baller_connected(struct Curl_cfilter *cf,
	{
	struct cf_hc_ctx *ctx = cf->ctx;
	CURLcode result = CURLE_OK;
+	int reply_ms;

	DEBUGASSERT(winner->cf);
	if(winner != &ctx->h3_baller)
@@ -181,9 +182,15 @@ static CURLcode baller_connected(struct Curl_cfilter *cf,
	if(winner != &ctx->h21_baller)
	cf_hc_baller_reset(&ctx->h21_baller, data);

-	CURL_TRC_CF(data, cf, "connect+handshake %s: %dms, 1st data: %dms",
-	winner->name, (int)Curl_timediff(Curl_now(), winner->started),
-	cf_hc_baller_reply_ms(winner, data));
+	reply_ms = cf_hc_baller_reply_ms(winner, data);
+	if(reply_ms >= 0)
+	CURL_TRC_CF(data, cf, "connect+handshake %s: %dms, 1st data: %dms",
+	winner->name, (int)Curl_timediff(Curl_now(), winner->started),
+	reply_ms);
+	else
+	CURL_TRC_CF(data, cf, "deferred handshake %s: %dms",
+	winner->name, (int)Curl_timediff(Curl_now(), winner->started));
+
	cf->next = winner->cf;
	winner->cf = NULL;

lib/getinfo.c+3 -0

@@ -449,6 +449,9 @@ static CURLcode getinfo_offt(struct Curl_easy *data, CURLINFO info,
	*param_offt = data->conn ?
	data->conn->connection_id : data->state.recent_conn_id;
	break;
+	case CURLINFO_EARLYDATA_SENT_T:
+	*param_offt = data->progress.earlydata_sent;
+	break;
	default:
	return CURLE_UNKNOWN_OPTION;
	}

lib/http2.c+17 -5

@@ -789,8 +789,11 @@ static ssize_t send_callback(nghttp2_session *h2,
	(void)flags;
	DEBUGASSERT(data);

-	nwritten = Curl_bufq_write_pass(&ctx->outbufq, buf, blen,
-	nw_out_writer, cf, &result);
+	if(!cf->connected)
+	nwritten = Curl_bufq_write(&ctx->outbufq, buf, blen, &result);
+	else
+	nwritten = Curl_bufq_write_pass(&ctx->outbufq, buf, blen,
+	nw_out_writer, cf, &result);
	if(nwritten < 0) {
	if(result == CURLE_AGAIN) {
	ctx->nw_out_blocked = 1;
@@ -1898,6 +1901,11 @@ out:
	nghttp2_strerror(rv), rv);
	return CURLE_SEND_ERROR;
	}
+	/* Defer flushing during the connect phase so that the SETTINGS and
+	* other initial frames are sent together with the first request.
+	* Unless we are 'connect_only' where the request will never come. */
+	if(!cf->connected && !cf->conn->connect_only)
+	return CURLE_OK;
	return nw_out_flush(cf, data);
	}

@@ -2439,6 +2447,7 @@ static CURLcode cf_h2_connect(struct Curl_cfilter *cf,
	struct cf_h2_ctx *ctx = cf->ctx;
	CURLcode result = CURLE_OK;
	struct cf_call_data save;
+	bool first_time = FALSE;

	if(cf->connected) {
	*done = TRUE;
@@ -2460,11 +2469,14 @@ static CURLcode cf_h2_connect(struct Curl_cfilter *cf,
	result = cf_h2_ctx_open(cf, data);
	if(result)
	goto out;
+	first_time = TRUE;
	}

-	result = h2_progress_ingress(cf, data, H2_CHUNK_SIZE);
-	if(result)
-	goto out;
+	if(!first_time) {
+	result = h2_progress_ingress(cf, data, H2_CHUNK_SIZE);
+	if(result)
+	goto out;
+	}

	/* Send out our SETTINGS and ACKs and such. If that blocks, we
	* have it buffered and can count this filter as being connected */

lib/progress.c+5 -0

@@ -381,6 +381,11 @@ void Curl_pgrsSetUploadSize(struct Curl_easy *data, curl_off_t size)
	}
	}

+	void Curl_pgrsEarlyData(struct Curl_easy *data, curl_off_t sent)
+	{
+	data->progress.earlydata_sent = sent;
+	}
+
	/* returns the average speed in bytes / second */
	static curl_off_t trspeed(curl_off_t size, /* number of bytes */
	curl_off_t us) /* microseconds */

lib/progress.h+2 -0

@@ -69,6 +69,8 @@ timediff_t Curl_pgrsLimitWaitTime(struct pgrs_dir *d,
	void Curl_pgrsTimeWas(struct Curl_easy *data, timerid timer,
	struct curltime timestamp);

+	void Curl_pgrsEarlyData(struct Curl_easy *data, curl_off_t sent);
+
	#define PGRS_HIDE (1<<4)
	#define PGRS_UL_SIZE_KNOWN (1<<5)
	#define PGRS_DL_SIZE_KNOWN (1<<6)

lib/setopt.c+1 -0

@@ -2369,6 +2369,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
	data->set.ssl.revoke_best_effort = !!(arg & CURLSSLOPT_REVOKE_BEST_EFFORT);
	data->set.ssl.native_ca_store = !!(arg & CURLSSLOPT_NATIVE_CA);
	data->set.ssl.auto_client_cert = !!(arg & CURLSSLOPT_AUTO_CLIENT_CERT);
+	data->set.ssl.earlydata = !!(arg & CURLSSLOPT_EARLYDATA);
	/* If a setting is added here it should also be added in dohprobe()
	which sets its own CURLOPT_SSL_OPTIONS based on these settings. */
	break;

lib/urldata.h+3 -0

@@ -324,6 +324,7 @@ struct ssl_config_data {
	char key_passwd; / plain text private key password */
	BIT(certinfo); /* gather lots of certificate info */
	BIT(falsestart);
+	BIT(earlydata); /* use tls1.3 early data */
	BIT(enable_beast); /* allow this flaw for interoperability's sake */
	BIT(no_revoke); /* disable SSL certificate revocation checks */
	BIT(no_partialchain); /* do not accept partial certificate chains */
@@ -346,6 +347,7 @@ struct Curl_ssl_session {
	char name; / hostname for which this ID was used */
	char conn_to_host; / hostname for the connection (may be NULL) */
	const char scheme; / protocol scheme used */
+	char alpn; / APLN TLS negotiated protocol string */
	void sessionid; / as returned from the SSL layer */
	size_t idsize; /* if known, otherwise 0 */
	Curl_ssl_sessionid_dtor sessionid_free; / free `sessionid` callback */
@@ -1069,6 +1071,7 @@ struct Progress {
	struct pgrs_dir dl;

	curl_off_t current_speed; /* uses the currently fastest transfer */
+	curl_off_t earlydata_sent;

	int width; /* screen width at download start */
	int flags; /* see progress.h */

lib/vtls/bearssl.c+4 -3

@@ -613,7 +613,8 @@ static CURLcode bearssl_connect_step1(struct Curl_cfilter *cf,

	CURL_TRC_CF(data, cf, "connect_step1, check session cache");
	Curl_ssl_sessionid_lock(data);
-	if(!Curl_ssl_getsessionid(cf, data, &connssl->peer, &session, NULL)) {
+	if(!Curl_ssl_getsessionid(cf, data, &connssl->peer,
+	&session, NULL, NULL)) {
	br_ssl_engine_set_session_parameters(&backend->ctx.eng, session);
	session_set = 1;
	infof(data, "BearSSL: reusing session ID");
@@ -823,7 +824,7 @@ static CURLcode bearssl_connect_step3(struct Curl_cfilter *cf,
	const char *proto;

	proto = br_ssl_engine_get_selected_protocol(&backend->ctx.eng);
-	Curl_alpn_set_negotiated(cf, data, (const unsigned char *)proto,
+	Curl_alpn_set_negotiated(cf, data, connssl, (const unsigned char *)proto,
	proto ? strlen(proto) : 0);
	}

@@ -835,7 +836,7 @@ static CURLcode bearssl_connect_step3(struct Curl_cfilter *cf,
	return CURLE_OUT_OF_MEMORY;
	br_ssl_engine_get_session_parameters(&backend->ctx.eng, session);
	Curl_ssl_sessionid_lock(data);
-	ret = Curl_ssl_set_sessionid(cf, data, &connssl->peer, session, 0,
+	ret = Curl_ssl_set_sessionid(cf, data, &connssl->peer, NULL, session, 0,
	bearssl_session_free);
	Curl_ssl_sessionid_unlock(data);
	if(ret)

lib/vtls/gtls.c+296 -72

@@ -50,6 +50,7 @@
	#include "vauth/vauth.h"
	#include "parsedate.h"
	#include "connect.h" /* for the connect timeout */
+	#include "progress.h"
	#include "select.h"
	#include "strcase.h"
	#include "warnless.h"
@@ -284,7 +285,7 @@ static CURLcode handshake(struct Curl_cfilter *cf,
	}
	else if(0 == what) {
	if(nonblocking)
-	return CURLE_OK;
+	return CURLE_AGAIN;
	else if(timeout_ms) {
	/* timeout */
	failf(data, "SSL connection timeout at %ld", (long)timeout_ms);
@@ -737,6 +738,9 @@ static CURLcode gtls_update_session_id(struct Curl_cfilter *cf,

	/* get the session ID data size */
	gnutls_session_get_data(session, NULL, &connect_idsize);
+	if(!connect_idsize) /* gnutls does this for some version combinations */
+	return CURLE_OK;
+
	connect_sessionid = malloc(connect_idsize); /* get a buffer for it */
	if(!connect_sessionid) {
	return CURLE_OUT_OF_MEMORY;
@@ -750,6 +754,7 @@ static CURLcode gtls_update_session_id(struct Curl_cfilter *cf,
	Curl_ssl_sessionid_lock(data);
	/* store this session id, takes ownership */
	result = Curl_ssl_set_sessionid(cf, data, &connssl->peer,
+	connssl->alpn_negotiated,
	connect_sessionid, connect_idsize,
	gtls_sessionid_free);
	Curl_ssl_sessionid_unlock(data);
@@ -845,9 +850,13 @@ static CURLcode gtls_client_init(struct Curl_cfilter *cf,
	init_flags \|= GNUTLS_FORCE_CLIENT_CERT;
	#endif

-	#if defined(GNUTLS_NO_TICKETS)
-	/* Disable TLS session tickets */
-	init_flags \|= GNUTLS_NO_TICKETS;
+	#if defined(GNUTLS_NO_TICKETS_TLS12)
+	init_flags \|= GNUTLS_NO_TICKETS_TLS12;
+	#elif defined(GNUTLS_NO_TICKETS)
+	/* Disable TLS session tickets for non 1.3 connections */
+	if((config->version != CURL_SSLVERSION_TLSv1_3) &&
+	(config->version != CURL_SSLVERSION_DEFAULT))
+	init_flags \|= GNUTLS_NO_TICKETS;
	#endif

	#if defined(GNUTLS_NO_STATUS_REQUEST)
@@ -1039,6 +1048,10 @@ CURLcode Curl_gtls_ctx_init(struct gtls_ctx *gctx,
	void *ssl_user_data)
	{
	struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
+	struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
+	struct ssl_connect_data *connssl = cf->ctx;
+	gnutls_datum_t gtls_alpns[5];
+	size_t gtls_alpns_count = 0;
	CURLcode result;

	DEBUGASSERT(gctx);
@@ -1061,52 +1074,90 @@ CURLcode Curl_gtls_ctx_init(struct gtls_ctx *gctx,
	gnutls_session_set_keylog_function(gctx->session, keylog_callback);
	}

+	/* This might be a reconnect, so we check for a session ID in the cache
+	to speed up things */
+	if(conn_config->cache_session) {
+	void *ssl_sessionid;
+	size_t ssl_idsize;
+	char *session_alpn;
+	Curl_ssl_sessionid_lock(data);
+	if(!Curl_ssl_getsessionid(cf, data, peer,
+	&ssl_sessionid, &ssl_idsize, &session_alpn)) {
+	/* we got a session id, use it! */
+	int rc;
+
+	rc = gnutls_session_set_data(gctx->session, ssl_sessionid, ssl_idsize);
+	if(rc < 0)
+	infof(data, "SSL failed to set session ID");
+	else {
+	infof(data, "SSL reusing session ID (size=%zu)", ssl_idsize);
+	#ifdef DEBUGBUILD
+	if((ssl_config->earlydata \|\| !!getenv("CURL_USE_EARLYDATA")) &&
+	#else
+	if(ssl_config->earlydata &&
+	#endif
+	!cf->conn->connect_only &&
+	(gnutls_protocol_get_version(gctx->session) == GNUTLS_TLS1_3) &&
+	Curl_alpn_contains_proto(connssl->alpn, session_alpn)) {
+	connssl->earlydata_max =
+	gnutls_record_get_max_early_data_size(gctx->session);
+	if((!connssl->earlydata_max \|\|
+	connssl->earlydata_max == 0xFFFFFFFFUL)) {
+	/* Seems to be GnuTLS way to signal no EarlyData in session */
+	CURL_TRC_CF(data, cf, "TLS session does not allow earlydata");
+	}
+	else {
+	CURL_TRC_CF(data, cf, "TLS session allows %zu earlydata bytes, "
+	"reusing ALPN '%s'",
+	connssl->earlydata_max, session_alpn);
+	connssl->earlydata_state = ssl_earlydata_use;
+	connssl->state = ssl_connection_deferred;
+	result = Curl_alpn_set_negotiated(cf, data, connssl,
+	(const unsigned char *)session_alpn,
+	session_alpn ? strlen(session_alpn) : 0);
+	if(result)
+	return result;
+	/* We only try the ALPN protocol the session used before,
+	* otherwise we might send early data for the wrong protocol */
+	gtls_alpns[0].data = (unsigned char *)session_alpn;
+	gtls_alpns[0].size = (unsigned)strlen(session_alpn);
+	gtls_alpns_count = 1;
+	}
+	}
+	}
+	}
+	Curl_ssl_sessionid_unlock(data);
+	}
+
	/* convert the ALPN string from our arguments to a list of strings
	* that gnutls wants and will convert internally back to this very
	* string for sending to the server. nice. */
-	if(alpn && alpn_len) {
-	gnutls_datum_t alpns[5];
+	if(!gtls_alpns_count && alpn && alpn_len) {
	size_t i, alen = alpn_len;
	unsigned char s = (unsigned char )alpn;
	unsigned char slen;
-	for(i = 0; (i < ARRAYSIZE(alpns)) && alen; ++i) {
+	for(i = 0; (i < ARRAYSIZE(gtls_alpns)) && alen; ++i) {
	slen = s[0];
	if(slen >= alen)
	return CURLE_FAILED_INIT;
-	alpns[i].data = s + 1;
-	alpns[i].size = slen;
+	gtls_alpns[i].data = s + 1;
+	gtls_alpns[i].size = slen;
	s += slen + 1;
	alen -= (size_t)slen + 1;
	}
	if(alen) /* not all alpn chars used, wrong format or too many */
	return CURLE_FAILED_INIT;
-	if(i && gnutls_alpn_set_protocols(gctx->session,
-	alpns, (unsigned int)i,
-	GNUTLS_ALPN_MANDATORY)) {
-	failf(data, "failed setting ALPN");
-	return CURLE_SSL_CONNECT_ERROR;
-	}
+	gtls_alpns_count = i;
	}

-	/* This might be a reconnect, so we check for a session ID in the cache
-	to speed up things */
-	if(conn_config->cache_session) {
-	void *ssl_sessionid;
-	size_t ssl_idsize;
-
-	Curl_ssl_sessionid_lock(data);
-	if(!Curl_ssl_getsessionid(cf, data, peer, &ssl_sessionid, &ssl_idsize)) {
-	/* we got a session id, use it! */
-	int rc;
-
-	rc = gnutls_session_set_data(gctx->session, ssl_sessionid, ssl_idsize);
-	if(rc < 0)
-	infof(data, "SSL failed to set session ID");
-	else
-	infof(data, "SSL reusing session ID (size=%zu)", ssl_idsize);
-	}
-	Curl_ssl_sessionid_unlock(data);
+	if(gtls_alpns_count &&
+	gnutls_alpn_set_protocols(gctx->session,
+	gtls_alpns, (unsigned int)gtls_alpns_count,
+	GNUTLS_ALPN_MANDATORY)) {
+	failf(data, "failed setting ALPN");
+	return CURLE_SSL_CONNECT_ERROR;
	}
+
	return CURLE_OK;
	}

@@ -1141,6 +1192,11 @@ gtls_connect_step1(struct Curl_cfilter cf, struct Curl_easy data)
	if(result)
	return result;

+	if(connssl->alpn && (connssl->state != ssl_connection_deferred)) {
+	Curl_alpn_to_proto_str(&proto, connssl->alpn);
+	infof(data, VTLS_INFOF_ALPN_OFFER_1STR, proto.data);
+	}
+
	gnutls_handshake_set_hook_function(backend->gtls.session,
	GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST,
	gtls_handshake_cb);
@@ -1675,17 +1731,6 @@ static CURLcode gtls_verifyserver(struct Curl_cfilter *cf,
	if(result)
	goto out;

-	if(connssl->alpn) {
-	gnutls_datum_t proto;
-	int rc;
-
-	rc = gnutls_alpn_get_selected_protocol(session, &proto);
-	if(rc == 0)
-	Curl_alpn_set_negotiated(cf, data, proto.data, proto.size);
-	else
-	Curl_alpn_set_negotiated(cf, data, NULL, 0);
-	}
-
	/* Only on TLSv1.2 or lower do we have the session id now. For
	* TLSv1.3 we get it via a SESSION_TICKET message that arrives later. */
	if(gnutls_protocol_get_version(session) < GNUTLS_TLS1_3)
@@ -1695,6 +1740,70 @@ out:
	return result;
	}

+	static CURLcode gtls_set_earlydata(struct Curl_cfilter *cf,
+	struct Curl_easy *data,
+	const void *buf, size_t blen)
+	{
+	struct ssl_connect_data *connssl = cf->ctx;
+	ssize_t nwritten = 0;
+	CURLcode result = CURLE_OK;
+
+	DEBUGASSERT(connssl->earlydata_state == ssl_earlydata_use);
+	DEBUGASSERT(Curl_bufq_is_empty(&connssl->earlydata));
+	if(blen) {
+	if(blen > connssl->earlydata_max)
+	blen = connssl->earlydata_max;
+	nwritten = Curl_bufq_write(&connssl->earlydata, buf, blen, &result);
+	CURL_TRC_CF(data, cf, "gtls_set_earlydata(len=%zu) -> %zd",
+	blen, nwritten);
+	if(nwritten < 0)
+	return result;
+	}
+	connssl->earlydata_state = ssl_earlydata_sending;
+	connssl->earlydata_skip = Curl_bufq_len(&connssl->earlydata);
+	return CURLE_OK;
+	}
+
+	static CURLcode gtls_send_earlydata(struct Curl_cfilter *cf,
+	struct Curl_easy *data)
+	{
+	struct ssl_connect_data *connssl = cf->ctx;
+	struct gtls_ssl_backend_data *backend =
+	(struct gtls_ssl_backend_data *)connssl->backend;
+	CURLcode result = CURLE_OK;
+	const unsigned char *buf;
+	size_t blen;
+	ssize_t n;
+
+	DEBUGASSERT(connssl->earlydata_state == ssl_earlydata_sending);
+	backend->gtls.io_result = CURLE_OK;
+	while(Curl_bufq_peek(&connssl->earlydata, &buf, &blen)) {
+	n = gnutls_record_send_early_data(backend->gtls.session, buf, blen);
+	CURL_TRC_CF(data, cf, "gtls_send_earlydata(len=%zu) -> %zd",
+	blen, n);
+	if(n < 0) {
+	if(n == GNUTLS_E_AGAIN)
+	result = CURLE_AGAIN;
+	else
+	result = backend->gtls.io_result ?
+	backend->gtls.io_result : CURLE_SEND_ERROR;
+	goto out;
+	}
+	else if(!n) {
+	/* gnutls is buggy, it SHOULD return the amount of bytes it took in.
+	* Instead it returns 0 if everything was written. */
+	n = (ssize_t)blen;
+	}
+
+	Curl_bufq_skip(&connssl->earlydata, (size_t)n);
+	}
+	/* sent everything there was */
+	infof(data, "SSL sending %" FMT_OFF_T " bytes of early data",
+	connssl->earlydata_skip);
+	out:
+	return result;
+	}
+
	/*
	* This function is called after the TCP connect has completed. Setup the TLS
	* layer and do all necessary magic.
@@ -1708,46 +1817,89 @@ static CURLcode
	gtls_connect_common(struct Curl_cfilter *cf,
	struct Curl_easy *data,
	bool nonblocking,
-	bool *done)
-	{
+	bool *done) {
	struct ssl_connect_data *connssl = cf->ctx;
-	CURLcode rc;
+	struct gtls_ssl_backend_data *backend =
+	(struct gtls_ssl_backend_data *)connssl->backend;
	CURLcode result = CURLE_OK;

+	DEBUGASSERT(backend);
+
	/* Initiate the connection, if not already done */
-	if(ssl_connect_1 == connssl->connecting_state) {
-	rc = gtls_connect_step1(cf, data);
-	if(rc) {
-	result = rc;
+	if(connssl->connecting_state == ssl_connect_1) {
+	result = gtls_connect_step1(cf, data);
+	if(result)
	goto out;
-	}
+	connssl->connecting_state = ssl_connect_2;
	}

-	rc = handshake(cf, data, TRUE, nonblocking);
-	if(rc) {
-	/* handshake() sets its own error message with failf() */
-	result = rc;
-	goto out;
+	if(connssl->connecting_state == ssl_connect_2) {
+	if(connssl->earlydata_state == ssl_earlydata_use) {
+	goto out;
+	}
+	else if(connssl->earlydata_state == ssl_earlydata_sending) {
+	result = gtls_send_earlydata(cf, data);
+	if(result)
+	goto out;
+	connssl->earlydata_state = ssl_earlydata_sent;
+	if(!Curl_ssl_cf_is_proxy(cf))
+	Curl_pgrsEarlyData(data, (curl_off_t)connssl->earlydata_skip);
+	}
+	DEBUGASSERT((connssl->earlydata_state == ssl_earlydata_none) \|\|
+	(connssl->earlydata_state == ssl_earlydata_sent));
+
+	result = handshake(cf, data, TRUE, nonblocking);
+	if(result)
+	goto out;
+	connssl->connecting_state = ssl_connect_3;
	}

	/* Finish connecting once the handshake is done */
-	if(ssl_connect_1 == connssl->connecting_state) {
-	struct gtls_ssl_backend_data *backend =
-	(struct gtls_ssl_backend_data *)connssl->backend;
-	gnutls_session_t session;
-	DEBUGASSERT(backend);
-	session = backend->gtls.session;
-	rc = gtls_verifyserver(cf, data, session);
-	if(rc) {
-	result = rc;
+	if(connssl->connecting_state == ssl_connect_3) {
+	gnutls_datum_t proto;
+	int rc;
+	result = gtls_verifyserver(cf, data, backend->gtls.session);
+	if(result)
	goto out;
-	}
+
	connssl->state = ssl_connection_complete;
+	connssl->connecting_state = ssl_connect_1;
+
+	rc = gnutls_alpn_get_selected_protocol(backend->gtls.session, &proto);
+	if(rc) { /* No ALPN from server */
+	proto.data = NULL;
+	proto.size = 0;
+	}
+
+	result = Curl_alpn_set_negotiated(cf, data, connssl,
+	proto.data, proto.size);
+	if(result)
+	goto out;
+
+	if(connssl->earlydata_state == ssl_earlydata_sent) {
+	if(gnutls_session_get_flags(backend->gtls.session) &
+	GNUTLS_SFLAGS_EARLY_DATA) {
+	connssl->earlydata_state = ssl_earlydata_accepted;
+	infof(data, "Server accepted %zu bytes of TLS early data.",
+	connssl->earlydata_skip);
+	}
+	else {
+	connssl->earlydata_state = ssl_earlydata_rejected;
+	if(!Curl_ssl_cf_is_proxy(cf))
+	Curl_pgrsEarlyData(data, -(curl_off_t)connssl->earlydata_skip);
+	infof(data, "Server rejected TLS early data.");
+	connssl->earlydata_skip = 0;
+	}
+	}
	}

	out:
-	*done = ssl_connect_1 == connssl->connecting_state;
-
+	if(result == CURLE_AGAIN) {
+	*done = FALSE;
+	return CURLE_OK;
+	}
+	*done = ((connssl->connecting_state == ssl_connect_1) \|\|
+	(connssl->state == ssl_connection_deferred));
	return result;
	}

@@ -1755,6 +1907,12 @@ static CURLcode gtls_connect_nonblocking(struct Curl_cfilter *cf,
	struct Curl_easy *data,
	bool *done)
	{
+	struct ssl_connect_data *connssl = cf->ctx;
+	if(connssl->state == ssl_connection_deferred) {
+	/* We refuse to be pushed, we are waiting for someone to send/recv. */
+	*done = TRUE;
+	return CURLE_OK;
+	}
	return gtls_connect_common(cf, data, TRUE, done);
	}

@@ -1773,6 +1931,26 @@ static CURLcode gtls_connect(struct Curl_cfilter *cf,
	return CURLE_OK;
	}

+	static CURLcode gtls_connect_deferred(struct Curl_cfilter *cf,
+	struct Curl_easy *data,
+	const void *buf,
+	size_t blen,
+	bool *done)
+	{
+	struct ssl_connect_data *connssl = cf->ctx;
+	CURLcode result = CURLE_OK;
+
+	DEBUGASSERT(connssl->state == ssl_connection_deferred);
+	*done = FALSE;
+	if(connssl->earlydata_state == ssl_earlydata_use) {
+	result = gtls_set_earlydata(cf, data, buf, blen);
+	if(result)
+	return result;
+	}
+
+	return gtls_connect_common(cf, data, TRUE, done);
+	}
+
	static bool gtls_data_pending(struct Curl_cfilter *cf,
	const struct Curl_easy *data)
	{
@@ -1800,8 +1978,38 @@ static ssize_t gtls_send(struct Curl_cfilter *cf,
	ssize_t rc;
	size_t nwritten, total_written = 0;

-	(void)data;
	DEBUGASSERT(backend);
+
+	if(connssl->state == ssl_connection_deferred) {
+	bool done = FALSE;
+	*curlcode = gtls_connect_deferred(cf, data, buf, blen, &done);
+	if(*curlcode) {
+	rc = -1;
+	goto out;
+	}
+	else if(!done) {
+	*curlcode = CURLE_AGAIN;
+	rc = -1;
+	goto out;
+	}
+	DEBUGASSERT(connssl->state == ssl_connection_complete);
+	}
+
+	if(connssl->earlydata_skip) {
+	if(connssl->earlydata_skip >= blen) {
+	connssl->earlydata_skip -= blen;
+	*curlcode = CURLE_OK;
+	rc = (ssize_t)blen;
+	goto out;
+	}
+	else {
+	total_written += connssl->earlydata_skip;
+	buf = ((const char *)buf) + connssl->earlydata_skip;
+	blen -= connssl->earlydata_skip;
+	connssl->earlydata_skip = 0;
+	}
+	}
+
	while(blen) {
	backend->gtls.io_result = CURLE_OK;
	rc = gnutls_record_send(backend->gtls.session, buf, blen);
@@ -1848,7 +2056,9 @@ static CURLcode gtls_shutdown(struct Curl_cfilter *cf,
	size_t i;

	DEBUGASSERT(backend);
-	if(!backend->gtls.session \|\| cf->shutdown) {
+	/* If we have no handshaked connection or already shut down */
+	if(!backend->gtls.session \|\| cf->shutdown \|\|
+	connssl->state != ssl_connection_complete) {
	*done = TRUE;
	goto out;
	}
@@ -1946,7 +2156,21 @@ static ssize_t gtls_recv(struct Curl_cfilter *cf,
	(void)data;
	DEBUGASSERT(backend);

-	backend->gtls.io_result = CURLE_OK;
+	if(connssl->state == ssl_connection_deferred) {
+	bool done = FALSE;
+	*curlcode = gtls_connect_deferred(cf, data, NULL, 0, &done);
+	if(*curlcode) {
+	ret = -1;
+	goto out;
+	}
+	else if(!done) {
+	*curlcode = CURLE_AGAIN;
+	ret = -1;
+	goto out;
+	}
+	DEBUGASSERT(connssl->state == ssl_connection_complete);
+	}
+
	ret = gnutls_record_recv(backend->gtls.session, buf, buffersize);
	if((ret == GNUTLS_E_AGAIN) \|\| (ret == GNUTLS_E_INTERRUPTED)) {
	*curlcode = CURLE_AGAIN;

lib/vtls/mbedtls.c+4 -3

@@ -877,7 +877,8 @@ mbed_connect_step1(struct Curl_cfilter cf, struct Curl_easy data)
	void *old_session = NULL;

	Curl_ssl_sessionid_lock(data);
-	if(!Curl_ssl_getsessionid(cf, data, &connssl->peer, &old_session, NULL)) {
+	if(!Curl_ssl_getsessionid(cf, data, &connssl->peer,
+	&old_session, NULL, NULL)) {
	ret = mbedtls_ssl_set_session(&backend->ssl, old_session);
	if(ret) {
	Curl_ssl_sessionid_unlock(data);
@@ -1093,7 +1094,7 @@ pinnedpubkey_error:
	if(connssl->alpn) {
	const char *proto = mbedtls_ssl_get_alpn_protocol(&backend->ssl);

-	Curl_alpn_set_negotiated(cf, data, (const unsigned char *)proto,
+	Curl_alpn_set_negotiated(cf, data, connssl, (const unsigned char *)proto,
	proto ? strlen(proto) : 0);
	}
	#endif
@@ -1144,7 +1145,7 @@ mbed_connect_step3(struct Curl_cfilter cf, struct Curl_easy data)

	/* If there is already a matching session in the cache, delete it */
	Curl_ssl_sessionid_lock(data);
-	retcode = Curl_ssl_set_sessionid(cf, data, &connssl->peer,
+	retcode = Curl_ssl_set_sessionid(cf, data, &connssl->peer, NULL,
	our_ssl_sessionid, 0,
	mbedtls_session_free);
	Curl_ssl_sessionid_unlock(data);

lib/vtls/openssl.c+4 -4

@@ -2914,7 +2914,7 @@ CURLcode Curl_ossl_add_session(struct Curl_cfilter *cf,
	}

	Curl_ssl_sessionid_lock(data);
-	result = Curl_ssl_set_sessionid(cf, data, peer, der_session_buf,
+	result = Curl_ssl_set_sessionid(cf, data, peer, NULL, der_session_buf,
	der_session_size, ossl_session_free);
	Curl_ssl_sessionid_unlock(data);
	}
@@ -3973,7 +3973,7 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
	if(ssl_config->primary.cache_session && transport == TRNSPRT_TCP) {
	Curl_ssl_sessionid_lock(data);
	if(!Curl_ssl_getsessionid(cf, data, peer, (void **)&der_sessionid,
-	&der_sessionid_size)) {
+	&der_sessionid_size, NULL)) {
	/* we got a session id, use it! */
	ssl_session = d2i_SSL_SESSION(NULL, &der_sessionid,
	(long)der_sessionid_size);
@@ -4377,7 +4377,7 @@ static CURLcode ossl_connect_step2(struct Curl_cfilter *cf,
	unsigned int len;
	SSL_get0_alpn_selected(octx->ssl, &neg_protocol, &len);

-	return Curl_alpn_set_negotiated(cf, data, neg_protocol, len);
+	return Curl_alpn_set_negotiated(cf, data, connssl, neg_protocol, len);
	}
	#endif

@@ -4710,7 +4710,7 @@ CURLcode Curl_oss_check_peer_cert(struct Curl_cfilter *cf,
	bool incache;
	Curl_ssl_sessionid_lock(data);
	incache = !(Curl_ssl_getsessionid(cf, data, peer,
-	&old_ssl_sessionid, NULL));
+	&old_ssl_sessionid, NULL, NULL));
	if(incache) {
	infof(data, "Remove session ID again from cache");
	Curl_ssl_delsessionid(data, old_ssl_sessionid);

lib/vtls/rustls.c+2 -1

@@ -768,11 +768,12 @@ static void
	cr_set_negotiated_alpn(struct Curl_cfilter cf, struct Curl_easy data,
	const struct rustls_connection *rconn)
	{
+	struct ssl_connect_data *const connssl = cf->ctx;
	const uint8_t *protocol = NULL;
	size_t len = 0;

	rustls_connection_get_alpn_protocol(rconn, &protocol, &len);
-	Curl_alpn_set_negotiated(cf, data, protocol, len);
+	Curl_alpn_set_negotiated(cf, data, connssl, protocol, len);
	}

	/* Given an established network connection, do a TLS handshake.

lib/vtls/schannel.c+5 -4

@@ -1130,7 +1130,7 @@ schannel_connect_step1(struct Curl_cfilter cf, struct Curl_easy data)
	if(ssl_config->primary.cache_session) {
	Curl_ssl_sessionid_lock(data);
	if(!Curl_ssl_getsessionid(cf, data, &connssl->peer,
-	(void **)&old_cred, NULL)) {
+	(void **)&old_cred, NULL, NULL)) {
	backend->cred = old_cred;
	DEBUGF(infof(data, "schannel: reusing existing credential handle"));

@@ -1752,7 +1752,7 @@ schannel_connect_step3(struct Curl_cfilter cf, struct Curl_easy data)
	SecApplicationProtocolNegotiationStatus_Success) {
	unsigned char prev_alpn = cf->conn->alpn;

-	Curl_alpn_set_negotiated(cf, data, alpn_result.ProtocolId,
+	Curl_alpn_set_negotiated(cf, data, connssl, alpn_result.ProtocolId,
	alpn_result.ProtocolIdSize);
	if(backend->recv_renegotiating) {
	if(prev_alpn != cf->conn->alpn &&
@@ -1766,7 +1766,7 @@ schannel_connect_step3(struct Curl_cfilter cf, struct Curl_easy data)
	}
	else {
	if(!backend->recv_renegotiating)
-	Curl_alpn_set_negotiated(cf, data, NULL, 0);
+	Curl_alpn_set_negotiated(cf, data, connssl, NULL, 0);
	}
	}
	#endif
@@ -1776,7 +1776,8 @@ schannel_connect_step3(struct Curl_cfilter cf, struct Curl_easy data)
	Curl_ssl_sessionid_lock(data);
	/* Up ref count since call takes ownership */
	backend->cred->refcount++;
-	result = Curl_ssl_set_sessionid(cf, data, &connssl->peer, backend->cred,
+	result = Curl_ssl_set_sessionid(cf, data, &connssl->peer, NULL,
+	backend->cred,
	sizeof(struct Curl_schannel_cred),
	schannel_session_free);
	Curl_ssl_sessionid_unlock(data);

lib/vtls/sectransp.c+4 -3

@@ -1334,7 +1334,8 @@ static CURLcode sectransp_connect_step1(struct Curl_cfilter *cf,

	Curl_ssl_sessionid_lock(data);
	if(!Curl_ssl_getsessionid(cf, data, &connssl->peer,
-	(void **)&ssl_sessionid, &ssl_sessionid_len)) {
+	(void **)&ssl_sessionid, &ssl_sessionid_len,
+	NULL)) {
	/* we got a session id, use it! */
	err = SSLSetPeerID(backend->ssl_ctx, ssl_sessionid, ssl_sessionid_len);
	Curl_ssl_sessionid_unlock(data);
@@ -1362,8 +1363,8 @@ static CURLcode sectransp_connect_step1(struct Curl_cfilter *cf,
	return CURLE_SSL_CONNECT_ERROR;
	}

-	result = Curl_ssl_set_sessionid(cf, data, &connssl->peer, ssl_sessionid,
-	ssl_sessionid_len,
+	result = Curl_ssl_set_sessionid(cf, data, &connssl->peer, NULL,
+	ssl_sessionid, ssl_sessionid_len,
	sectransp_session_free);
	Curl_ssl_sessionid_unlock(data);
	if(result)

lib/vtls/vtls.c+86 -6

@@ -454,6 +454,7 @@ static struct ssl_connect_data cf_ctx_new(struct Curl_easy data,
	return NULL;

	ctx->alpn = alpn;
+	Curl_bufq_init2(&ctx->earlydata, CURL_SSL_EARLY_MAX, 1, BUFQ_OPT_NO_SPARES);
	ctx->backend = calloc(1, Curl_ssl->sizeof_ssl_backend_data);
	if(!ctx->backend) {
	free(ctx);
@@ -465,6 +466,8 @@ static struct ssl_connect_data cf_ctx_new(struct Curl_easy data,
	static void cf_ctx_free(struct ssl_connect_data *ctx)
	{
	if(ctx) {
+	Curl_safefree(ctx->alpn_negotiated);
+	Curl_bufq_free(&ctx->earlydata);
	free(ctx->backend);
	free(ctx);
	}
@@ -527,7 +530,8 @@ bool Curl_ssl_getsessionid(struct Curl_cfilter *cf,
	struct Curl_easy *data,
	const struct ssl_peer *peer,
	void **ssl_sessionid,
-	size_t idsize) / set 0 if unknown */
+	size_t idsize, / set 0 if unknown */
+	char **palpn)
	{
	struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
	struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
@@ -537,6 +541,8 @@ bool Curl_ssl_getsessionid(struct Curl_cfilter *cf,
	bool no_match = TRUE;

	*ssl_sessionid = NULL;
+	if(palpn)
+	*palpn = NULL;
	if(!ssl_config)
	return TRUE;

@@ -575,6 +581,8 @@ bool Curl_ssl_getsessionid(struct Curl_cfilter *cf,
	*ssl_sessionid = check->sessionid;
	if(idsize)
	*idsize = check->idsize;
+	if(palpn)
+	*palpn = check->alpn;
	no_match = FALSE;
	break;
	}
@@ -605,6 +613,7 @@ void Curl_ssl_kill_session(struct Curl_ssl_session *session)

	Curl_safefree(session->name);
	Curl_safefree(session->conn_to_host);
+	Curl_safefree(session->alpn);
	}
	}

@@ -628,6 +637,7 @@ void Curl_ssl_delsessionid(struct Curl_easy data, void ssl_sessionid)
	CURLcode Curl_ssl_set_sessionid(struct Curl_cfilter *cf,
	struct Curl_easy *data,
	const struct ssl_peer *peer,
+	const char *alpn,
	void *ssl_sessionid,
	size_t idsize,
	Curl_ssl_sessionid_dtor *sessionid_free_cb)
@@ -639,6 +649,7 @@ CURLcode Curl_ssl_set_sessionid(struct Curl_cfilter *cf,
	long oldest_age;
	char *clone_host = NULL;
	char *clone_conn_to_host = NULL;
+	char *clone_alpn = NULL;
	int conn_to_port;
	long *general_age;
	void *old_sessionid;
@@ -653,7 +664,7 @@ CURLcode Curl_ssl_set_sessionid(struct Curl_cfilter *cf,
	return CURLE_OK;
	}

-	if(!Curl_ssl_getsessionid(cf, data, peer, &old_sessionid, &old_size)) {
+	if(!Curl_ssl_getsessionid(cf, data, peer, &old_sessionid, &old_size, NULL)) {
	if((old_size == idsize) &&
	((old_sessionid == ssl_sessionid) \|\|
	(idsize && !memcmp(old_sessionid, ssl_sessionid, idsize)))) {
@@ -679,6 +690,10 @@ CURLcode Curl_ssl_set_sessionid(struct Curl_cfilter *cf,
	goto out;
	}

+	clone_alpn = alpn ? strdup(alpn) : NULL;
+	if(alpn && !clone_alpn)
+	goto out;
+
	if(cf->conn->bits.conn_to_port)
	conn_to_port = cf->conn->conn_to_port;
	else
@@ -727,6 +742,8 @@ CURLcode Curl_ssl_set_sessionid(struct Curl_cfilter *cf,
	store->conn_to_host = clone_conn_to_host; /* clone connect to hostname */
	clone_conn_to_host = NULL;
	store->conn_to_port = conn_to_port; /* connect to port number */
+	store->alpn = clone_alpn;
+	clone_alpn = NULL;
	/* port number */
	store->remote_port = peer->port;
	store->scheme = cf->conn->handler->scheme;
@@ -737,6 +754,7 @@ CURLcode Curl_ssl_set_sessionid(struct Curl_cfilter *cf,
	out:
	free(clone_host);
	free(clone_conn_to_host);
+	free(clone_alpn);
	if(result) {
	failf(data, "Failed to add Session ID to cache for %s://%s:%d [%s]",
	store->scheme, store->name, store->remote_port,
@@ -1716,7 +1734,9 @@ static CURLcode ssl_cf_connect(struct Curl_cfilter *cf,
	if(!result && *done) {
	cf->connected = TRUE;
	connssl->handshake_done = Curl_now();
-	DEBUGASSERT(connssl->state == ssl_connection_complete);
+	/* Connection can be deferred when sending early data */
+	DEBUGASSERT(connssl->state == ssl_connection_complete \|\|
+	connssl->state == ssl_connection_deferred);
	}
	out:
	CURL_TRC_CF(data, cf, "cf_connect() -> %d, done=%d", result, *done);
@@ -2219,11 +2239,25 @@ CURLcode Curl_alpn_to_proto_str(struct alpn_proto_buf *buf,
	return CURLE_OK;
	}

+	bool Curl_alpn_contains_proto(const struct alpn_spec *spec,
+	const char *proto)
+	{
+	size_t i, plen = proto ? strlen(proto) : 0;
+	for(i = 0; spec && plen && i < spec->count; ++i) {
+	size_t slen = strlen(spec->entries[i]);
+	if((slen == plen) && !memcmp(proto, spec->entries[i], plen))
+	return TRUE;
+	}
+	return FALSE;
+	}
+
	CURLcode Curl_alpn_set_negotiated(struct Curl_cfilter *cf,
	struct Curl_easy *data,
+	struct ssl_connect_data *connssl,
	const unsigned char *proto,
	size_t proto_len)
	{
+	CURLcode result = CURLE_OK;
	unsigned char *palpn =
	#ifndef CURL_DISABLE_PROXY
	(cf->conn->bits.tunnel_proxy && Curl_ssl_cf_is_proxy(cf)) ?
@@ -2233,6 +2267,45 @@ CURLcode Curl_alpn_set_negotiated(struct Curl_cfilter *cf,
	#endif
	;

+	if(connssl->alpn_negotiated) {
+	/* When we ask for a specific ALPN protocol, we need the confirmation
+	* of it by the server, as we have installed protocol handler and
+	* connection filter chain for exactly this protocol. */
+	if(!proto_len) {
+	failf(data, "ALPN: asked for '%s' from previous session, "
+	"but server did not confirm it. Refusing to continue.",
+	connssl->alpn_negotiated);
+	result = CURLE_SSL_CONNECT_ERROR;
+	goto out;
+	}
+	else if((strlen(connssl->alpn_negotiated) != proto_len) \|\|
+	memcmp(connssl->alpn_negotiated, proto, proto_len)) {
+	failf(data, "ALPN: asked for '%s' from previous session, but server "
+	"selected '%.*s'. Refusing to continue.",
+	connssl->alpn_negotiated, (int)proto_len, proto);
+	result = CURLE_SSL_CONNECT_ERROR;
+	goto out;
+	}
+	/* ALPN is exactly what we asked for, done. */
+	infof(data, "ALPN: server confirmed to use '%s'",
+	connssl->alpn_negotiated);
+	goto out;
+	}
+
+	if(proto && proto_len) {
+	if(memchr(proto, '\0', proto_len)) {
+	failf(data, "ALPN: server selected protocol contains NUL. "
+	"Refusing to continue.");
+	result = CURLE_SSL_CONNECT_ERROR;
+	goto out;
+	}
+	connssl->alpn_negotiated = malloc(proto_len + 1);
+	if(!connssl->alpn_negotiated)
+	return CURLE_OUT_OF_MEMORY;
+	memcpy(connssl->alpn_negotiated, proto, proto_len);
+	connssl->alpn_negotiated[proto_len] = 0;
+	}
+
	if(proto && proto_len) {
	if(proto_len == ALPN_HTTP_1_1_LENGTH &&
	!memcmp(ALPN_HTTP_1_1, proto, ALPN_HTTP_1_1_LENGTH)) {
@@ -2258,15 +2331,22 @@ CURLcode Curl_alpn_set_negotiated(struct Curl_cfilter *cf,
	/* return CURLE_NOT_BUILT_IN; */
	goto out;
	}
-	infof(data, VTLS_INFOF_ALPN_ACCEPTED_LEN_1STR, (int)proto_len, proto);
+
+	if(connssl->state == ssl_connection_deferred)
+	infof(data, VTLS_INFOF_ALPN_DEFERRED, (int)proto_len, proto);
+	else
+	infof(data, VTLS_INFOF_ALPN_ACCEPTED, (int)proto_len, proto);
	}
	else {
	*palpn = CURL_HTTP_VERSION_NONE;
-	infof(data, VTLS_INFOF_NO_ALPN);
+	if(connssl->state == ssl_connection_deferred)
+	infof(data, VTLS_INFOF_NO_ALPN_DEFERRED);
+	else
+	infof(data, VTLS_INFOF_NO_ALPN);
	}

	out:
-	return CURLE_OK;
+	return result;
	}

	#endif /* USE_SSL */

lib/vtls/vtls.h+8 -5

@@ -43,15 +43,18 @@ struct Curl_ssl_session;

	#define ALPN_ACCEPTED "ALPN: server accepted "

-	#define VTLS_INFOF_NO_ALPN \
+	#define VTLS_INFOF_NO_ALPN \
	"ALPN: server did not agree on a protocol. Uses default."
-	#define VTLS_INFOF_ALPN_OFFER_1STR \
+	#define VTLS_INFOF_ALPN_OFFER_1STR \
	"ALPN: curl offers %s"
-	#define VTLS_INFOF_ALPN_ACCEPTED_1STR \
-	ALPN_ACCEPTED "%s"
-	#define VTLS_INFOF_ALPN_ACCEPTED_LEN_1STR \
+	#define VTLS_INFOF_ALPN_ACCEPTED \
	ALPN_ACCEPTED "%.*s"

+	#define VTLS_INFOF_NO_ALPN_DEFERRED \
+	"ALPN: deferred handshake for early data without specific protocol."
+	#define VTLS_INFOF_ALPN_DEFERRED \
+	"ALPN: deferred handshake for early data using '%.*s'."
+
	/* Curl_multi SSL backend-specific data; declared differently by each SSL
	backend */
	struct Curl_cfilter;

lib/vtls/vtls_int.h+35 -1

@@ -29,6 +29,8 @@

	#ifdef USE_SSL

+	struct ssl_connect_data;
+
	/* see https://www.iana.org/assignments/tls-extensiontype-values/ */
	#define ALPN_HTTP_1_1_LENGTH 8
	#define ALPN_HTTP_1_1 "http/1.1"
@@ -61,9 +63,13 @@ CURLcode Curl_alpn_to_proto_str(struct alpn_proto_buf *buf,

	CURLcode Curl_alpn_set_negotiated(struct Curl_cfilter *cf,
	struct Curl_easy *data,
+	struct ssl_connect_data *connssl,
	const unsigned char *proto,
	size_t proto_len);

+	bool Curl_alpn_contains_proto(const struct alpn_spec *spec,
+	const char *proto);
+
	/* enum for the nonblocking SSL connection state machine */
	typedef enum {
	ssl_connect_1,
@@ -74,14 +80,27 @@ typedef enum {

	typedef enum {
	ssl_connection_none,
+	ssl_connection_deferred,
	ssl_connection_negotiating,
	ssl_connection_complete
	} ssl_connection_state;

+	typedef enum {
+	ssl_earlydata_none,
+	ssl_earlydata_use,
+	ssl_earlydata_sending,
+	ssl_earlydata_sent,
+	ssl_earlydata_accepted,
+	ssl_earlydata_rejected
+	} ssl_earlydata_state;
+
	#define CURL_SSL_IO_NEED_NONE (0)
	#define CURL_SSL_IO_NEED_RECV (1<<0)
	#define CURL_SSL_IO_NEED_SEND (1<<1)

+	/* Max earlydata payload we want to send */
+	#define CURL_SSL_EARLY_MAX (64*1024)
+
	/* Information in each SSL cfilter context: cf->ctx */
	struct ssl_connect_data {
	struct ssl_peer peer;
@@ -89,8 +108,14 @@ struct ssl_connect_data {
	void backend; / vtls backend specific props */
	struct cf_call_data call_data; /* data handle used in current call */
	struct curltime handshake_done; /* time when handshake finished */
+	char alpn_negotiated; / negotiated ALPN value or NULL */
+	struct bufq earlydata; /* earlydata to be send to peer */
+	size_t earlydata_max; /* max earlydata allowed by peer */
+	size_t earlydata_skip; /* sending bytes to skip when earlydata
+	* is accepted by peer */
	ssl_connection_state state;
	ssl_connect_state connecting_state;
+	ssl_earlydata_state earlydata_state;
	int io_need; /* TLS signals special SEND/RECV needs */
	BIT(use_alpn); /* if ALPN shall be used in handshake */
	BIT(peer_closed); /* peer has closed connection */
@@ -193,12 +218,20 @@ bool Curl_ssl_cf_is_proxy(struct Curl_cfilter *cf);
	* Caller must make sure that the ownership of returned sessionid object
	* is properly taken (e.g. its refcount is incremented
	* under sessionid mutex).
+	* @param cf the connection filter wanting to use it
+	* @param data the transfer involved
+	* @param peer the peer the filter wants to talk to
+	* @param sessionid on return the TLS session
+	* @param idsize on return the size of the TLS session data
+	* @param palpn on return the ALPN string used by the session,
+	* set to NULL when not interested
	*/
	bool Curl_ssl_getsessionid(struct Curl_cfilter *cf,
	struct Curl_easy *data,
	const struct ssl_peer *peer,
	void **ssl_sessionid,
-	size_t idsize); / set 0 if unknown */
+	size_t idsize, / set 0 if unknown */
+	char **palpn);

	/* Set a TLS session ID for `peer`. Replaces an existing session ID if
	* not already the very same.
@@ -212,6 +245,7 @@ bool Curl_ssl_getsessionid(struct Curl_cfilter *cf,
	CURLcode Curl_ssl_set_sessionid(struct Curl_cfilter *cf,
	struct Curl_easy *data,
	const struct ssl_peer *peer,
+	const char *alpn,
	void *sessionid,
	size_t sessionid_size,
	Curl_ssl_sessionid_dtor *sessionid_free_cb);

lib/vtls/wolfssl.c+5 -5

@@ -1059,7 +1059,7 @@ wolfssl_connect_step1(struct Curl_cfilter cf, struct Curl_easy data)

	Curl_ssl_sessionid_lock(data);
	if(!Curl_ssl_getsessionid(cf, data, &connssl->peer,
-	&ssl_sessionid, NULL)) {
+	&ssl_sessionid, NULL, NULL)) {
	/* we got a session id, use it! */
	if(!SSL_set_session(backend->handle, ssl_sessionid)) {
	Curl_ssl_delsessionid(data, ssl_sessionid);
@@ -1406,11 +1406,11 @@ wolfssl_connect_step2(struct Curl_cfilter cf, struct Curl_easy data)
	rc = wolfSSL_ALPN_GetProtocol(backend->handle, &protocol, &protocol_len);

	if(rc == SSL_SUCCESS) {
-	Curl_alpn_set_negotiated(cf, data, (const unsigned char *)protocol,
-	protocol_len);
+	Curl_alpn_set_negotiated(cf, data, connssl,
+	(const unsigned char *)protocol, protocol_len);
	}
	else if(rc == SSL_ALPN_NOT_FOUND)
-	Curl_alpn_set_negotiated(cf, data, NULL, 0);
+	Curl_alpn_set_negotiated(cf, data, connssl, NULL, 0);
	else {
	failf(data, "ALPN, failure getting protocol, error %d", rc);
	return CURLE_SSL_CONNECT_ERROR;
@@ -1457,7 +1457,7 @@ wolfssl_connect_step3(struct Curl_cfilter cf, struct Curl_easy data)
	if(our_ssl_sessionid) {
	Curl_ssl_sessionid_lock(data);
	/* call takes ownership of `our_ssl_sessionid` */
-	result = Curl_ssl_set_sessionid(cf, data, &connssl->peer,
+	result = Curl_ssl_set_sessionid(cf, data, &connssl->peer, NULL,
	our_ssl_sessionid, 0,
	wolfssl_session_free);
	Curl_ssl_sessionid_unlock(data);

src/tool_cfgable.h+1 -0

@@ -261,6 +261,7 @@ struct OperationConfig {
	bool xattr; /* store metadata in extended attributes */
	long gssapi_delegation;
	bool ssl_allow_beast; /* allow this SSL vulnerability */
+	bool ssl_allow_earlydata; /* allow use of TLSv1.3 early data */
	bool proxy_ssl_allow_beast; /* allow this SSL vulnerability for proxy */
	bool ssl_no_revoke; /* disable SSL certificate revocation checks */
	bool ssl_revoke_best_effort; /* ignore SSL revocation offline/missing

src/tool_getparam.c+5 -0

@@ -316,6 +316,7 @@ static const struct LongShort aliases[]= {
	{"tftp-blksize", ARG_STRG, ' ', C_TFTP_BLKSIZE},
	{"tftp-no-options", ARG_BOOL, ' ', C_TFTP_NO_OPTIONS},
	{"time-cond", ARG_STRG, 'z', C_TIME_COND},
+	{"tls-earlydata", ARG_BOOL, ' ', C_TLS_EARLYDATA},
	{"tls-max", ARG_STRG, ' ', C_TLS_MAX},
	{"tls13-ciphers", ARG_STRG, ' ', C_TLS13_CIPHERS},
	{"tlsauthtype", ARG_STRG, ' ', C_TLSAUTHTYPE},
@@ -1691,6 +1692,10 @@ ParameterError getparameter(const char flag, / f or -long-flag */
	config->abstract_unix_socket = TRUE;
	err = getstr(&config->unix_socket_path, nextarg, DENY_BLANK);
	break;
+	case C_TLS_EARLYDATA: /* --tls-earlydata */
+	if(feature_ssl)
+	config->ssl_allow_earlydata = toggle;
+	break;
	case C_TLS_MAX: /* --tls-max */
	err = str2tls_max(&config->ssl_version_max, nextarg);
	break;

src/tool_getparam.h+1 -0

@@ -271,6 +271,7 @@ typedef enum {
	C_TFTP_BLKSIZE,
	C_TFTP_NO_OPTIONS,
	C_TIME_COND,
+	C_TLS_EARLYDATA,
	C_TLS_MAX,
	C_TLS13_CIPHERS,
	C_TLSAUTHTYPE,

src/tool_listhelp.c+3 -0

@@ -748,6 +748,9 @@ const struct helptxt helptext[] = {
	{"-z, --time-cond <time>",
	"Transfer based on a time condition",
	CURLHELP_HTTP \| CURLHELP_FTP},
+	{" --tls-earlydata",
+	"Allow use of TLSv1.3 early data (0RTT)",
+	CURLHELP_TLS},
	{" --tls-max <VERSION>",
	"Maximum allowed TLS version",
	CURLHELP_TLS},

src/tool_operate.c+2 -0

@@ -1932,6 +1932,8 @@ static CURLcode single_transfer(struct GlobalConfig *global,
	long mask =
	(config->ssl_allow_beast ?
	CURLSSLOPT_ALLOW_BEAST : 0) \|
+	(config->ssl_allow_earlydata ?
+	CURLSSLOPT_EARLYDATA : 0) \|
	(config->ssl_no_revoke ?
	CURLSSLOPT_NO_REVOKE : 0) \|
	(config->ssl_revoke_best_effort ?

tests/http/clients/hx-download.c+51 -7

@@ -228,8 +228,10 @@ static int my_progress_cb(void *userdata,
	}

	static int setup(CURL hnd, const char url, struct transfer *t,
-	int http_version)
+	int http_version, struct curl_slist *host,
+	CURLSH *share, int use_earlydata)
	{
+	curl_easy_setopt(hnd, CURLOPT_SHARE, share);
	curl_easy_setopt(hnd, CURLOPT_URL, url);
	curl_easy_setopt(hnd, CURLOPT_HTTP_VERSION, http_version);
	curl_easy_setopt(hnd, CURLOPT_SSL_VERIFYPEER, 0L);
@@ -240,8 +242,12 @@ static int setup(CURL hnd, const char url, struct transfer *t,
	curl_easy_setopt(hnd, CURLOPT_NOPROGRESS, 0L);
	curl_easy_setopt(hnd, CURLOPT_XFERINFOFUNCTION, my_progress_cb);
	curl_easy_setopt(hnd, CURLOPT_XFERINFODATA, t);
+	if(use_earlydata)
+	curl_easy_setopt(hnd, CURLOPT_SSL_OPTIONS, (long)CURLSSLOPT_EARLYDATA);
	if(forbid_reuse)
	curl_easy_setopt(hnd, CURLOPT_FORBID_REUSE, 1L);
+	if(host)
+	curl_easy_setopt(hnd, CURLOPT_RESOLVE, host);

	/* please be verbose */
	if(verbose) {
@@ -265,10 +271,14 @@ static void usage(const char *msg)
	" download a url with following options:\n"
	" -a abort paused transfer\n"
	" -m number max parallel downloads\n"
-	" -n number total downloads\n"
+	" -e use TLS early data when possible\n"
+	" -f forbid connection reuse\n"
+	" -n number total downloads\n");
+	fprintf(stderr,
	" -A number abort transfer after `number` response bytes\n"
	" -F number fail writing response after `number` response bytes\n"
	" -P number pause transfer after `number` response bytes\n"
+	" -r <host>:<port>:<addr> resolve information\n"
	" -V http_version (http/1.1, h2, h3) http version to use\n"
	);
	}
@@ -282,18 +292,21 @@ int main(int argc, char *argv[])
	#ifndef _MSC_VER
	CURLM *multi_handle;
	struct CURLMsg *m;
+	CURLSH *share;
	const char *url;
	size_t i, n, max_parallel = 1;
	size_t active_transfers;
	size_t pause_offset = 0;
	size_t abort_offset = 0;
	size_t fail_offset = 0;
-	int abort_paused = 0;
+	int abort_paused = 0, use_earlydata = 0;
	struct transfer *t;
	int http_version = CURL_HTTP_VERSION_2_0;
	int ch;
+	struct curl_slist *host = NULL;
+	const char *resolve = NULL;

-	while((ch = getopt(argc, argv, "afhm:n:A:F:P:V:")) != -1) {
+	while((ch = getopt(argc, argv, "aefhm:n:A:F:P:r:V:")) != -1) {
	switch(ch) {
	case 'h':
	usage(NULL);
@@ -301,6 +314,9 @@ int main(int argc, char *argv[])
	case 'a':
	abort_paused = 1;
	break;
+	case 'e':
+	use_earlydata = 1;
+	break;
	case 'f':
	forbid_reuse = 1;
	break;
@@ -319,6 +335,9 @@ int main(int argc, char *argv[])
	case 'P':
	pause_offset = (size_t)strtol(optarg, NULL, 10);
	break;
+	case 'r':
+	resolve = optarg;
+	break;
	case 'V': {
	if(!strcmp("http/1.1", optarg))
	http_version = CURL_HTTP_VERSION_1_1;
@@ -349,6 +368,21 @@ int main(int argc, char *argv[])
	}
	url = argv[0];

+	if(resolve)
+	host = curl_slist_append(NULL, resolve);
+
+	share = curl_share_init();
+	if(!share) {
+	fprintf(stderr, "error allocating share\n");
+	return 1;
+	}
+	curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_COOKIE);
+	curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_DNS);
+	curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_SSL_SESSION);
+	curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_CONNECT);
+	curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_PSL);
+	curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_HSTS);
+
	transfers = calloc(transfer_count, sizeof(*transfers));
	if(!transfers) {
	fprintf(stderr, "error allocating transfer structs\n");
@@ -371,7 +405,8 @@ int main(int argc, char *argv[])
	for(i = 0; i < n; ++i) {
	t = &transfers[i];
	t->easy = curl_easy_init();
-	if(!t->easy \|\| setup(t->easy, url, t, http_version)) {
+	if(!t->easy \|\|
+	setup(t->easy, url, t, http_version, host, share, use_earlydata)) {
	fprintf(stderr, "[t-%d] FAILED setup\n", (int)i);
	return 1;
	}
@@ -404,6 +439,11 @@ int main(int argc, char *argv[])
	if(t) {
	t->done = 1;
	fprintf(stderr, "[t-%d] FINISHED\n", t->idx);
+	if(use_earlydata) {
+	curl_off_t sent;
+	curl_easy_getinfo(e, CURLINFO_EARLYDATA_SENT_T, &sent);
+	fprintf(stderr, "[t-%d] EarlyData: %ld\n", t->idx, (long)sent);
+	}
	}
	else {
	curl_easy_cleanup(e);
@@ -444,7 +484,9 @@ int main(int argc, char *argv[])
	t = &transfers[i];
	if(!t->started) {
	t->easy = curl_easy_init();
-	if(!t->easy \|\| setup(t->easy, url, t, http_version)) {
+	if(!t->easy \|\|
+	setup(t->easy, url, t, http_version, host, share,
+	use_earlydata)) {
	fprintf(stderr, "[t-%d] FAILED setup\n", (int)i);
	return 1;
	}
@@ -463,6 +505,8 @@ int main(int argc, char *argv[])

	} while(active_transfers); /* as long as we have transfers going */

+	curl_multi_cleanup(multi_handle);
+
	for(i = 0; i < transfer_count; ++i) {
	t = &transfers[i];
	if(t->out) {
@@ -476,7 +520,7 @@ int main(int argc, char *argv[])
	}
	free(transfers);

-	curl_multi_cleanup(multi_handle);
+	curl_share_cleanup(share);

	return 0;
	#else

tests/http/clients/hx-upload.c+54 -5

@@ -252,8 +252,10 @@ static int my_progress_cb(void *userdata,
	}

	static int setup(CURL hnd, const char url, struct transfer *t,
-	int http_version)
+	int http_version, struct curl_slist *host,
+	CURLSH *share, int use_earlydata, int announce_length)
	{
+	curl_easy_setopt(hnd, CURLOPT_SHARE, share);
	curl_easy_setopt(hnd, CURLOPT_URL, url);
	curl_easy_setopt(hnd, CURLOPT_HTTP_VERSION, http_version);
	curl_easy_setopt(hnd, CURLOPT_SSL_VERIFYPEER, 0L);
@@ -261,6 +263,8 @@ static int setup(CURL hnd, const char url, struct transfer *t,
	curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, (long)(128 * 1024));
	curl_easy_setopt(hnd, CURLOPT_WRITEFUNCTION, my_write_cb);
	curl_easy_setopt(hnd, CURLOPT_WRITEDATA, t);
+	if(use_earlydata)
+	curl_easy_setopt(hnd, CURLOPT_SSL_OPTIONS, (long)CURLSSLOPT_EARLYDATA);

	if(!t->method \|\| !strcmp("PUT", t->method))
	curl_easy_setopt(hnd, CURLOPT_UPLOAD, 1L);
@@ -272,11 +276,16 @@ static int setup(CURL hnd, const char url, struct transfer *t,
	}
	curl_easy_setopt(hnd, CURLOPT_READFUNCTION, my_read_cb);
	curl_easy_setopt(hnd, CURLOPT_READDATA, t);
+	if(announce_length)
+	curl_easy_setopt(hnd, CURLOPT_INFILESIZE_LARGE, t->send_total);
+
	curl_easy_setopt(hnd, CURLOPT_NOPROGRESS, 0L);
	curl_easy_setopt(hnd, CURLOPT_XFERINFOFUNCTION, my_progress_cb);
	curl_easy_setopt(hnd, CURLOPT_XFERINFODATA, t);
	if(forbid_reuse)
	curl_easy_setopt(hnd, CURLOPT_FORBID_REUSE, 1L);
+	if(host)
+	curl_easy_setopt(hnd, CURLOPT_RESOLVE, host);

	/* please be verbose */
	if(verbose) {
@@ -299,11 +308,13 @@ static void usage(const char *msg)
	"usage: [options] url\n"
	" upload to a url with following options:\n"
	" -a abort paused transfer\n"
+	" -e use TLS earlydata\n"
	" -m number max parallel uploads\n"
	" -n number total uploads\n"
	" -A number abort transfer after `number` request body bytes\n"
	" -F number fail reading request body after `number` of bytes\n"
	" -P number pause transfer after `number` request body bytes\n"
+	" -r <host>:<port>:<addr> resolve information\n"
	" -S number size to upload\n"
	" -V http_version (http/1.1, h2, h3) http version to use\n"
	);
@@ -318,6 +329,7 @@ int main(int argc, char *argv[])
	#ifndef _MSC_VER
	CURLM *multi_handle;
	struct CURLMsg *m;
+	CURLSH *share;
	const char *url;
	const char *method = "PUT";
	size_t i, n, max_parallel = 1;
@@ -328,11 +340,15 @@ int main(int argc, char *argv[])
	size_t send_total = (128 * 1024);
	int abort_paused = 0;
	int reuse_easy = 0;
+	int use_earlydata = 0;
+	int announce_length = 0;
	struct transfer *t;
	int http_version = CURL_HTTP_VERSION_2_0;
+	struct curl_slist *host = NULL;
+	const char *resolve = NULL;
	int ch;

-	while((ch = getopt(argc, argv, "afhm:n:A:F:M:P:RS:V:")) != -1) {
+	while((ch = getopt(argc, argv, "aefhlm:n:A:F:M:P:r:RS:V:")) != -1) {
	switch(ch) {
	case 'h':
	usage(NULL);
@@ -340,9 +356,15 @@ int main(int argc, char *argv[])
	case 'a':
	abort_paused = 1;
	break;
+	case 'e':
+	use_earlydata = 1;
+	break;
	case 'f':
	forbid_reuse = 1;
	break;
+	case 'l':
+	announce_length = 1;
+	break;
	case 'm':
	max_parallel = (size_t)strtol(optarg, NULL, 10);
	break;
@@ -361,6 +383,9 @@ int main(int argc, char *argv[])
	case 'P':
	pause_offset = (size_t)strtol(optarg, NULL, 10);
	break;
+	case 'r':
+	resolve = optarg;
+	break;
	case 'R':
	reuse_easy = 1;
	break;
@@ -402,6 +427,21 @@ int main(int argc, char *argv[])
	}
	url = argv[0];

+	if(resolve)
+	host = curl_slist_append(NULL, resolve);
+
+	share = curl_share_init();
+	if(!share) {
+	fprintf(stderr, "error allocating share\n");
+	return 1;
+	}
+	curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_COOKIE);
+	curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_DNS);
+	curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_SSL_SESSION);
+	curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_CONNECT);
+	curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_PSL);
+	curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_HSTS);
+
	transfers = calloc(transfer_count, sizeof(*transfers));
	if(!transfers) {
	fprintf(stderr, "error allocating transfer structs\n");
@@ -429,7 +469,8 @@ int main(int argc, char *argv[])
	for(i = 0; i < transfer_count; ++i) {
	t = &transfers[i];
	t->easy = easy;
-	if(setup(t->easy, url, t, http_version)) {
+	if(setup(t->easy, url, t, http_version, host, share, use_earlydata,
+	announce_length)) {
	fprintf(stderr, "[t-%d] FAILED setup\n", (int)i);
	return 1;
	}
@@ -450,7 +491,8 @@ int main(int argc, char *argv[])
	for(i = 0; i < n; ++i) {
	t = &transfers[i];
	t->easy = curl_easy_init();
-	if(!t->easy \|\| setup(t->easy, url, t, http_version)) {
+	if(!t->easy \|\| setup(t->easy, url, t, http_version, host, share,
+	use_earlydata, announce_length)) {
	fprintf(stderr, "[t-%d] FAILED setup\n", (int)i);
	return 1;
	}
@@ -483,6 +525,11 @@ int main(int argc, char *argv[])
	if(t) {
	t->done = 1;
	fprintf(stderr, "[t-%d] FINISHED\n", t->idx);
+	if(use_earlydata) {
+	curl_off_t sent;
+	curl_easy_getinfo(e, CURLINFO_EARLYDATA_SENT_T, &sent);
+	fprintf(stderr, "[t-%d] EarlyData: %ld\n", t->idx, (long)sent);
+	}
	}
	else {
	curl_easy_cleanup(e);
@@ -523,7 +570,8 @@ int main(int argc, char *argv[])
	t = &transfers[i];
	if(!t->started) {
	t->easy = curl_easy_init();
-	if(!t->easy \|\| setup(t->easy, url, t, http_version)) {
+	if(!t->easy \|\| setup(t->easy, url, t, http_version, host,
+	share, use_earlydata, announce_length)) {
	fprintf(stderr, "[t-%d] FAILED setup\n", (int)i);
	return 1;
	}
@@ -557,6 +605,7 @@ int main(int argc, char *argv[])
	}
	}
	free(transfers);
+	curl_share_cleanup(share);

	return 0;
	#else

tests/http/test_02_download.py+46 -0

@@ -29,6 +29,7 @@ import filecmp
	import logging
	import math
	import os
+	import re
	from datetime import timedelta
	import pytest

@@ -591,3 +592,48 @@ class TestDownload:
	# we see 3 connections, because Apache only every serves a single
	# request via Upgrade: and then closed the connection.
	assert r.total_connects == 3, r.dump_logs()
+
+	# nghttpx is the only server we have that supports TLS early data
+	@pytest.mark.skipif(condition=not Env.have_nghttpx(), reason="no nghttpx")
+	@pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
+	def test_02_32_earlydata(self, env: Env, httpd, nghttpx, proto):
+	if not env.curl_uses_lib('gnutls'):
+	pytest.skip('TLS earlydata only implemented in GnuTLS')
+	if proto == 'h3' and not env.have_h3():
+	pytest.skip("h3 not supported")
+	count = 2
+	docname = 'data-10k'
+	# we want this test to always connect to nghttpx, since it is
+	# the only server we have that supports TLS earlydata
+	port = env.port_for(proto)
+	if proto != 'h3':
+	port = env.nghttpx_https_port
+	# url = f'https://{env.domain1}:{env.port_for(proto)}/{docname}'
+	url = f'https://{env.domain1}:{port}/{docname}'
+	client = LocalClient(name='hx-download', env=env)
+	if not client.exists():
+	pytest.skip(f'example client not built: {client.name}')
+	r = client.run(args=[
+	'-n', f'{count}',
+	'-e', # use TLS earlydata
+	'-f', # forbid reuse of connections
+	'-r', f'{env.domain1}:{port}:127.0.0.1',
+	'-V', proto, url
+	])
+	r.check_exit_code(0)
+	srcfile = os.path.join(httpd.docs_dir, docname)
+	self.check_downloads(client, srcfile, count)
+	# check that TLS earlydata worked as expected
+	earlydata = {}
+	for line in r.trace_lines:
+	m = re.match(r'^\[t-(\d+)] EarlyData: (\d+)', line)
+	if m:
+	earlydata[int(m.group(1))] = int(m.group(2))
+	assert earlydata[0] == 0, f'{earlydata}'
+	if proto == 'http/1.1':
+	assert earlydata[1] == 69, f'{earlydata}'
+	elif proto == 'h2':
+	assert earlydata[1] == 107, f'{earlydata}'
+	elif proto == 'h3':
+	# not implemented
+	assert earlydata[1] == 0, f'{earlydata}'

tests/http/test_07_upload.py+47 -0

@@ -28,6 +28,7 @@ import difflib
	import filecmp
	import logging
	import os
+	import re
	import pytest
	from typing import List

@@ -43,6 +44,7 @@ class TestUpload:
	def _class_scope(self, env, httpd, nghttpx):
	if env.have_h3():
	nghttpx.start_if_needed()
+	env.make_data_file(indir=env.gen_dir, fname="data-10k", fsize=10*1024)
	env.make_data_file(indir=env.gen_dir, fname="data-63k", fsize=63*1024)
	env.make_data_file(indir=env.gen_dir, fname="data-64k", fsize=64*1024)
	env.make_data_file(indir=env.gen_dir, fname="data-100k", fsize=100*1024)
@@ -651,6 +653,51 @@ class TestUpload:
	])
	r.check_stats(count=1, http_status=200, exitcode=0)

+	# nghttpx is the only server we have that supports TLS early data and
+	# has a limit of 16k it announces
+	@pytest.mark.skipif(condition=not Env.have_nghttpx(), reason="no nghttpx")
+	@pytest.mark.parametrize("proto,upload_size,exp_early", [
+	['http/1.1', 100, 203], # headers+body
+	['http/1.1', 10*1024, 10345], # headers+body
+	['http/1.1', 32*1024, 16384], # headers+body, limited by server max
+	['h2', 10*1024, 10378], # headers+body
+	['h2', 32*1024, 16384], # headers+body, limited by server max
+	['h3', 1024, 0], # earlydata not supported
+	])
+	def test_07_70_put_earlydata(self, env: Env, httpd, nghttpx, proto, upload_size, exp_early):
+	if not env.curl_uses_lib('gnutls'):
+	pytest.skip('TLS earlydata only implemented in GnuTLS')
+	if proto == 'h3' and not env.have_h3():
+	pytest.skip("h3 not supported")
+	count = 2
+	# we want this test to always connect to nghttpx, since it is
+	# the only server we have that supports TLS earlydata
+	port = env.port_for(proto)
+	if proto != 'h3':
+	port = env.nghttpx_https_port
+	url = f'https://{env.domain1}:{port}/curltest/put?id=[0-{count-1}]'
+	client = LocalClient(name='hx-upload', env=env)
+	if not client.exists():
+	pytest.skip(f'example client not built: {client.name}')
+	r = client.run(args=[
+	'-n', f'{count}',
+	'-e', # use TLS earlydata
+	'-f', # forbid reuse of connections
+	'-l', # announce upload length, no 'Expect: 100'
+	'-S', f'{upload_size}',
+	'-r', f'{env.domain1}:{port}:127.0.0.1',
+	'-V', proto, url
+	])
+	r.check_exit_code(0)
+	self.check_downloads(client, [f"{upload_size}"], count)
+	earlydata = {}
+	for line in r.trace_lines:
+	m = re.match(r'^\[t-(\d+)] EarlyData: (\d+)', line)
+	if m:
+	earlydata[int(m.group(1))] = int(m.group(2))
+	assert earlydata[0] == 0, f'{earlydata}'
+	assert earlydata[1] == exp_early, f'{earlydata}'
+
	def check_downloads(self, client, source: List[str], count: int,
	complete: bool = True):
	for i in range(count):

tests/http/test_08_caddy.py+45 -1

@@ -24,11 +24,14 @@
	#
	###########################################################################
	#
+	import difflib
+	import filecmp
	import logging
	import os
+	import re
	import pytest

-	from testenv import Env, CurlClient, Caddy
+	from testenv import Env, CurlClient, Caddy, LocalClient


	log = logging.getLogger(__name__)
@@ -57,6 +60,7 @@ class TestCaddy:

	@pytest.fixture(autouse=True, scope='class')
	def _class_scope(self, env, caddy):
+	self._make_docs_file(docs_dir=caddy.docs_dir, fname='data10k.data', fsize=10*1024)
	self._make_docs_file(docs_dir=caddy.docs_dir, fname='data1.data', fsize=1024*1024)
	self._make_docs_file(docs_dir=caddy.docs_dir, fname='data5.data', fsize=510241024)
	self._make_docs_file(docs_dir=caddy.docs_dir, fname='data10.data', fsize=1010241024)
@@ -205,3 +209,43 @@ class TestCaddy:
	for i in range(count):
	respdata = open(curl.response_file(i)).readlines()
	assert respdata == exp_data
+
+	@pytest.mark.parametrize("proto", ['http/1.1', 'h2'])
+	def test_08_08_earlydata(self, env: Env, httpd, caddy, proto):
+	count = 2
+	docname = 'data10k.data'
+	url = f'https://{env.domain1}:{caddy.port}/{docname}'
+	client = LocalClient(name='hx-download', env=env)
+	if not client.exists():
+	pytest.skip(f'example client not built: {client.name}')
+	r = client.run(args=[
+	'-n', f'{count}',
+	'-e', # use TLS earlydata
+	'-f', # forbid reuse of connections
+	'-r', f'{env.domain1}:{caddy.port}:127.0.0.1',
+	'-V', proto, url
+	])
+	r.check_exit_code(0)
+	srcfile = os.path.join(caddy.docs_dir, docname)
+	self.check_downloads(client, srcfile, count)
+	earlydata = {}
+	for line in r.trace_lines:
+	m = re.match(r'^\[t-(\d+)] EarlyData: (\d+)', line)
+	if m:
+	earlydata[int(m.group(1))] = int(m.group(2))
+	# Caddy does not support early data
+	assert earlydata[0] == 0, f'{earlydata}'
+	assert earlydata[1] == 0, f'{earlydata}'
+
+	def check_downloads(self, client, srcfile: str, count: int,
+	complete: bool = True):
+	for i in range(count):
+	dfile = client.download_file(i)
+	assert os.path.exists(dfile)
+	if complete and not filecmp.cmp(srcfile, dfile, shallow=False):
+	diff = "".join(difflib.unified_diff(a=open(srcfile).readlines(),
+	b=open(dfile).readlines(),
+	fromfile=srcfile,
+	tofile=dfile,
+	n=1))
+	assert False, f'download {dfile} differs:\n{diff}'

tests/http/test_17_ssl_use.py+3 -4

@@ -64,9 +64,6 @@ class TestSSLUse:
	count = 3
	exp_resumed = 'Resumed'
	xargs = ['--sessionid', '--tls-max', tls_max, f'--tlsv{tls_max}']
-	if env.curl_uses_lib('gnutls'):
-	if tls_max == '1.3':
-	exp_resumed = 'Initial' # 1.2 works in GnuTLS, but 1.3 does not, TODO
	if env.curl_uses_lib('libressl'):
	if tls_max == '1.3':
	exp_resumed = 'Initial' # 1.2 works in LibreSSL, but 1.3 does not, TODO
@@ -279,7 +276,9 @@ class TestSSLUse:
	])
	httpd.reload_if_config_changed()
	proto = 'http/1.1'
-	curl = CurlClient(env=env)
+	run_env = os.environ.copy()
+	run_env['CURL_USE_EARLYDATA'] = '1'
+	curl = CurlClient(env=env, run_env=run_env)
	url = f'https://{env.authority_for(env.domain1, proto)}/curltest/sslinfo'
	# SSL backend specifics
	if env.curl_uses_lib('bearssl'):

tests/http/testenv/env.py+5 -0

@@ -110,6 +110,7 @@ class EnvConfig:
	'ftps': socket.SOCK_STREAM,
	'http': socket.SOCK_STREAM,
	'https': socket.SOCK_STREAM,
+	'nghttpx_https': socket.SOCK_STREAM,
	'proxy': socket.SOCK_STREAM,
	'proxys': socket.SOCK_STREAM,
	'h2proxys': socket.SOCK_STREAM,
@@ -472,6 +473,10 @@ class Env:
	def https_port(self) -> int:
	return self.CONFIG.ports['https']

+	@property
+	def nghttpx_https_port(self) -> int:
+	return self.CONFIG.ports['nghttpx_https']
+
	@property
	def h3_port(self) -> int:
	return self.https_port

tests/http/testenv/nghttpx.py+1 -0

@@ -184,6 +184,7 @@ class NghttpxQuic(Nghttpx):
	args = [
	self._cmd,
	f'--frontend=*,{self.env.h3_port};quic',
+	f'--frontend=*,{self.env.nghttpx_https_port};tls',
	f'--backend=127.0.0.1,{self.env.https_port};{self.env.domain1};sni={self.env.domain1};proto=h2;tls',
	f'--backend=127.0.0.1,{self.env.http_port}',
	'--log-level=INFO',