Restoring authorship annotation for <orivej@yandex-team.ru>. Commit 2 of 2.

14 files changed, 4681 insertions, 4681 deletions

diff --git a/contrib/libs/curl/lib/vtls/gskit.c b/contrib/libs/curl/lib/vtls/gskit.c
index b58bd270de..17584c750f 100644
--- a/contrib/libs/curl/lib/vtls/gskit.c
+++ b/contrib/libs/curl/lib/vtls/gskit.c
@@ -645,7 +645,7 @@ static ssize_t gskit_recv(struct connectdata *conn, int num, char *buf,
   CURLcode cc = CURLE_RECV_ERROR;
 
   if(pipe_ssloverssl(conn, num, SOS_READ) >= 0) {
-    int buffsize = buffersize > (size_t) INT_MAX? INT_MAX: (int) buffersize; 
+    int buffsize = buffersize > (size_t) INT_MAX? INT_MAX: (int) buffersize;
     cc = gskit_status(data, gsk_secure_soc_read(BACKEND->handle,
                                                 buf, buffsize, &nread),
                       "gsk_secure_soc_read()", CURLE_RECV_ERROR);
@@ -990,8 +990,8 @@ static CURLcode gskit_connect_step3(struct connectdata *conn, int sockindex)
                                                     &cdev, &cdec),
                   "gsk_attribute_get_cert_info()", CURLE_SSL_CONNECT_ERROR) ==
      CURLE_OK) {
-    int i; 
- 
+    int i;
+
     infof(data, "Server certificate:\n");
     p = cdev;
     for(i = 0; i++ < cdec; p++)
@@ -1173,10 +1173,10 @@ static int Curl_gskit_shutdown(struct connectdata *conn, int sockindex)
   if(!BACKEND->handle)
     return 0;
 
-#ifndef CURL_DISABLE_FTP 
+#ifndef CURL_DISABLE_FTP
   if(data->set.ftp_ccc != CURLFTPSSL_CCC_ACTIVE)
     return 0;
-#endif 
+#endif
 
   close_one(connssl, conn, sockindex);
   rc = 0;
@@ -1184,8 +1184,8 @@ static int Curl_gskit_shutdown(struct connectdata *conn, int sockindex)
                          SSL_SHUTDOWN_TIMEOUT);
 
   for(;;) {
-    ssize_t nread; 
- 
+    ssize_t nread;
+
     if(what < 0) {
       /* anything that gets here is fatally bad */
       failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO);
diff --git a/contrib/libs/curl/lib/vtls/gtls.c b/contrib/libs/curl/lib/vtls/gtls.c
index ce654828ab..e848c3f05a 100644
--- a/contrib/libs/curl/lib/vtls/gtls.c
+++ b/contrib/libs/curl/lib/vtls/gtls.c
@@ -55,7 +55,7 @@
 #include "strcase.h"
 #include "warnless.h"
 #include "x509asn1.h"
-#include "multiif.h" 
+#include "multiif.h"
 #include "curl_printf.h"
 #include "curl_memory.h"
 /* The last #include file should be: */
@@ -213,8 +213,8 @@ static CURLcode handshake(struct connectdata *conn,
 
   for(;;) {
     timediff_t timeout_ms;
-    int rc; 
- 
+    int rc;
+
     /* check allowed time left */
     timeout_ms = Curl_timeleft(data, NULL, duringconnect);
 
@@ -227,7 +227,7 @@ static CURLcode handshake(struct connectdata *conn,
     /* if ssl is expecting something, check if it's available. */
     if(connssl->connecting_state == ssl_connect_2_reading
        || connssl->connecting_state == ssl_connect_2_writing) {
-      int what; 
+      int what;
       curl_socket_t writefd = ssl_connect_2_writing ==
         connssl->connecting_state?sockfd:CURL_SOCKET_BAD;
       curl_socket_t readfd = ssl_connect_2_reading ==
@@ -766,8 +766,8 @@ static CURLcode pkp_pin_peer_pubkey(struct Curl_easy *data,
     return result;
 
   do {
-    int ret; 
- 
+    int ret;
+
     /* Begin Gyrations to get the public key     */
     gnutls_pubkey_init(&key);
 
@@ -1081,7 +1081,7 @@ gtls_connect_step3(struct connectdata *conn,
     #define use_addr in_addr
 #endif
     unsigned char addrbuf[sizeof(struct use_addr)];
-    size_t addrlen = 0; 
+    size_t addrlen = 0;
 
     if(Curl_inet_pton(AF_INET, hostname, addrbuf) > 0)
       addrlen = 4;
@@ -1091,13 +1091,13 @@ gtls_connect_step3(struct connectdata *conn,
 #endif
 
     if(addrlen) {
-      unsigned char certaddr[sizeof(struct use_addr)]; 
-      int i; 
- 
+      unsigned char certaddr[sizeof(struct use_addr)];
+      int i;
+
       for(i = 0; ; i++) {
-        size_t certaddrlen = sizeof(certaddr); 
-        int ret = gnutls_x509_crt_get_subject_alt_name(x509_cert, i, certaddr, 
-                                                       &certaddrlen, NULL); 
+        size_t certaddrlen = sizeof(certaddr);
+        int ret = gnutls_x509_crt_get_subject_alt_name(x509_cert, i, certaddr,
+                                                       &certaddrlen, NULL);
         /* If this happens, it wasn't an IP address. */
         if(ret == GNUTLS_E_SHORT_MEMORY_BUFFER)
           continue;
@@ -1262,9 +1262,9 @@ gtls_connect_step3(struct connectdata *conn,
     }
     else
       infof(data, "ALPN, server did not agree to a protocol\n");
- 
-    Curl_multiuse_state(conn, conn->negnpn == CURL_HTTP_VERSION_2 ? 
-                        BUNDLE_MULTIPLEX : BUNDLE_NO_MULTIUSE); 
+
+    Curl_multiuse_state(conn, conn->negnpn == CURL_HTTP_VERSION_2 ?
+                        BUNDLE_MULTIPLEX : BUNDLE_NO_MULTIUSE);
   }
 
   conn->ssl[sockindex].state = ssl_connection_complete;
@@ -1284,9 +1284,9 @@ gtls_connect_step3(struct connectdata *conn,
     connect_sessionid = malloc(connect_idsize); /* get a buffer for it */
 
     if(connect_sessionid) {
-      bool incache; 
-      void *ssl_sessionid; 
- 
+      bool incache;
+      void *ssl_sessionid;
+
       /* extract session ID to the allocated buffer */
       gnutls_session_get_data(session, connect_sessionid, &connect_idsize);
 
@@ -1459,7 +1459,7 @@ static int Curl_gtls_shutdown(struct connectdata *conn, int sockindex)
   int retval = 0;
   struct Curl_easy *data = conn->data;
 
-#ifndef CURL_DISABLE_FTP 
+#ifndef CURL_DISABLE_FTP
   /* This has only been tested on the proftpd server, and the mod_tls code
      sends a close notify alert without waiting for a close notify alert in
      response. Thus we wait for a close notify alert from the server, but
@@ -1467,13 +1467,13 @@ static int Curl_gtls_shutdown(struct connectdata *conn, int sockindex)
 
   if(data->set.ftp_ccc == CURLFTPSSL_CCC_ACTIVE)
     gnutls_bye(backend->session, GNUTLS_SHUT_WR);
-#endif 
+#endif
 
   if(backend->session) {
-    ssize_t result; 
-    bool done = FALSE; 
-    char buf[120]; 
- 
+    ssize_t result;
+    bool done = FALSE;
+    char buf[120];
+
     while(!done) {
       int what = SOCKET_READABLE(conn->sock[sockindex],
                                  SSL_SHUTDOWN_TIMEOUT);
diff --git a/contrib/libs/curl/lib/vtls/mbedtls.c b/contrib/libs/curl/lib/vtls/mbedtls.c
index 626ffea919..e30f660fbb 100644
--- a/contrib/libs/curl/lib/vtls/mbedtls.c
+++ b/contrib/libs/curl/lib/vtls/mbedtls.c
@@ -63,7 +63,7 @@
 #include "parsedate.h"
 #include "connect.h" /* for the connect timeout */
 #include "select.h"
-#include "multiif.h" 
+#include "multiif.h"
 #error #include "mbedtls_threadlock.h"
 
 /* The last 3 #include files should be in this order */
@@ -386,7 +386,7 @@ mbed_connect_step1(struct connectdata *conn,
     }
   }
 
-  infof(data, "mbedTLS: Connecting to %s:%ld\n", hostname, port); 
+  infof(data, "mbedTLS: Connecting to %s:%ld\n", hostname, port);
 
   mbedtls_ssl_config_init(&backend->config);
 
@@ -572,8 +572,8 @@ mbed_connect_step2(struct connectdata *conn,
     return CURLE_OK;
   }
   else if(ret) {
-    char errorbuf[128]; 
-    errorbuf[0] = 0; 
+    char errorbuf[128];
+    errorbuf[0] = 0;
 #ifdef MBEDTLS_ERROR_C
     mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
 #endif /* MBEDTLS_ERROR_C */
@@ -588,21 +588,21 @@ mbed_connect_step2(struct connectdata *conn,
 
   ret = mbedtls_ssl_get_verify_result(&backend->ssl);
 
-  if(!SSL_CONN_CONFIG(verifyhost)) 
-    /* Ignore hostname errors if verifyhost is disabled */ 
-    ret &= ~MBEDTLS_X509_BADCERT_CN_MISMATCH; 
- 
+  if(!SSL_CONN_CONFIG(verifyhost))
+    /* Ignore hostname errors if verifyhost is disabled */
+    ret &= ~MBEDTLS_X509_BADCERT_CN_MISMATCH;
+
   if(ret && SSL_CONN_CONFIG(verifypeer)) {
     if(ret & MBEDTLS_X509_BADCERT_EXPIRED)
       failf(data, "Cert verify failed: BADCERT_EXPIRED");
 
-    else if(ret & MBEDTLS_X509_BADCERT_REVOKED) 
+    else if(ret & MBEDTLS_X509_BADCERT_REVOKED)
       failf(data, "Cert verify failed: BADCERT_REVOKED");
 
-    else if(ret & MBEDTLS_X509_BADCERT_CN_MISMATCH) 
+    else if(ret & MBEDTLS_X509_BADCERT_CN_MISMATCH)
       failf(data, "Cert verify failed: BADCERT_CN_MISMATCH");
 
-    else if(ret & MBEDTLS_X509_BADCERT_NOT_TRUSTED) 
+    else if(ret & MBEDTLS_X509_BADCERT_NOT_TRUSTED)
       failf(data, "Cert verify failed: BADCERT_NOT_TRUSTED");
 
     else if(ret & MBEDTLS_X509_BADCERT_FUTURE)
@@ -701,8 +701,8 @@ mbed_connect_step2(struct connectdata *conn,
     else {
       infof(data, "ALPN, server did not agree to a protocol\n");
     }
-    Curl_multiuse_state(conn, conn->negnpn == CURL_HTTP_VERSION_2 ? 
-                        BUNDLE_MULTIPLEX : BUNDLE_NO_MULTIUSE); 
+    Curl_multiuse_state(conn, conn->negnpn == CURL_HTTP_VERSION_2 ?
+                        BUNDLE_MULTIPLEX : BUNDLE_NO_MULTIUSE);
   }
 #endif
 
@@ -736,8 +736,8 @@ mbed_connect_step3(struct connectdata *conn,
 
     ret = mbedtls_ssl_get_session(&backend->ssl, our_ssl_sessionid);
     if(ret) {
-      if(ret != MBEDTLS_ERR_SSL_ALLOC_FAILED) 
-        mbedtls_ssl_session_free(our_ssl_sessionid); 
+      if(ret != MBEDTLS_ERR_SSL_ALLOC_FAILED)
+        mbedtls_ssl_session_free(our_ssl_sessionid);
       free(our_ssl_sessionid);
       failf(data, "mbedtls_ssl_get_session returned -0x%x", -ret);
       return CURLE_SSL_CONNECT_ERROR;
@@ -751,7 +751,7 @@ mbed_connect_step3(struct connectdata *conn,
     retcode = Curl_ssl_addsessionid(conn, our_ssl_sessionid, 0, sockindex);
     Curl_ssl_sessionid_unlock(conn);
     if(retcode) {
-      mbedtls_ssl_session_free(our_ssl_sessionid); 
+      mbedtls_ssl_session_free(our_ssl_sessionid);
       free(our_ssl_sessionid);
       failf(data, "failed to store ssl session");
       return retcode;
@@ -839,14 +839,14 @@ static void Curl_mbedtls_session_free(void *ptr)
 
 static size_t Curl_mbedtls_version(char *buffer, size_t size)
 {
-#ifdef MBEDTLS_VERSION_C 
-  /* if mbedtls_version_get_number() is available it is better */ 
+#ifdef MBEDTLS_VERSION_C
+  /* if mbedtls_version_get_number() is available it is better */
   unsigned int version = mbedtls_version_get_number();
   return msnprintf(buffer, size, "mbedTLS/%u.%u.%u", version>>24,
                    (version>>16)&0xff, (version>>8)&0xff);
-#else 
-  return msnprintf(buffer, size, "mbedTLS/%s", MBEDTLS_VERSION_STRING); 
-#endif 
+#else
+  return msnprintf(buffer, size, "mbedTLS/%s", MBEDTLS_VERSION_STRING);
+#endif
 }
 
 static CURLcode Curl_mbedtls_random(struct Curl_easy *data,
diff --git a/contrib/libs/curl/lib/vtls/mesalink.c b/contrib/libs/curl/lib/vtls/mesalink.c
index 134e218800..309786cf83 100644
--- a/contrib/libs/curl/lib/vtls/mesalink.c
+++ b/contrib/libs/curl/lib/vtls/mesalink.c
@@ -73,17 +73,17 @@ struct ssl_backend_data
 static Curl_recv mesalink_recv;
 static Curl_send mesalink_send;
 
-static int do_file_type(const char *type) 
-{ 
-  if(!type || !type[0]) 
-    return SSL_FILETYPE_PEM; 
-  if(strcasecompare(type, "PEM")) 
-    return SSL_FILETYPE_PEM; 
-  if(strcasecompare(type, "DER")) 
-    return SSL_FILETYPE_ASN1; 
-  return -1; 
-} 
- 
+static int do_file_type(const char *type)
+{
+  if(!type || !type[0])
+    return SSL_FILETYPE_PEM;
+  if(strcasecompare(type, "PEM"))
+    return SSL_FILETYPE_PEM;
+  if(strcasecompare(type, "DER"))
+    return SSL_FILETYPE_ASN1;
+  return -1;
+}
+
 /*
  * This function loads all the client/CA certificates and CRLs. Setup the TLS
  * layer and do all necessary magic.
@@ -150,25 +150,25 @@ mesalink_connect_step1(struct connectdata *conn, int sockindex)
   }
 
   SSL_CTX_set_verify(
-    BACKEND->ctx, SSL_CONN_CONFIG(verifypeer) ? 
-      SSL_VERIFY_PEER : SSL_VERIFY_NONE, NULL); 
+    BACKEND->ctx, SSL_CONN_CONFIG(verifypeer) ?
+      SSL_VERIFY_PEER : SSL_VERIFY_NONE, NULL);
 
-  if(SSL_CONN_CONFIG(CAfile) || SSL_CONN_CONFIG(CApath)) { 
-    if(!SSL_CTX_load_verify_locations(BACKEND->ctx, SSL_CONN_CONFIG(CAfile), 
-                                                    SSL_CONN_CONFIG(CApath))) { 
-      if(SSL_CONN_CONFIG(verifypeer)) { 
+  if(SSL_CONN_CONFIG(CAfile) || SSL_CONN_CONFIG(CApath)) {
+    if(!SSL_CTX_load_verify_locations(BACKEND->ctx, SSL_CONN_CONFIG(CAfile),
+                                                    SSL_CONN_CONFIG(CApath))) {
+      if(SSL_CONN_CONFIG(verifypeer)) {
         failf(data,
               "error setting certificate verify locations: "
               " CAfile: %s CApath: %s",
-              SSL_CONN_CONFIG(CAfile) ? 
-              SSL_CONN_CONFIG(CAfile) : "none", 
-              SSL_CONN_CONFIG(CApath) ? 
-              SSL_CONN_CONFIG(CApath) : "none"); 
+              SSL_CONN_CONFIG(CAfile) ?
+              SSL_CONN_CONFIG(CAfile) : "none",
+              SSL_CONN_CONFIG(CApath) ?
+              SSL_CONN_CONFIG(CApath) : "none");
         return CURLE_SSL_CACERT_BADFILE;
       }
       infof(data,
-          "error setting certificate verify locations," 
-          " continuing anyway:\n"); 
+          "error setting certificate verify locations,"
+          " continuing anyway:\n");
     }
     else {
       infof(data, "successfully set certificate verify locations:\n");
@@ -180,28 +180,28 @@ mesalink_connect_step1(struct connectdata *conn, int sockindex)
   }
 
   if(SSL_SET_OPTION(primary.clientcert) && SSL_SET_OPTION(key)) {
-    int file_type = do_file_type(SSL_SET_OPTION(cert_type)); 
- 
+    int file_type = do_file_type(SSL_SET_OPTION(cert_type));
+
     if(SSL_CTX_use_certificate_chain_file(BACKEND->ctx,
                                           SSL_SET_OPTION(primary.clientcert),
                                           file_type) != 1) {
-      failf(data, "unable to use client certificate (no key or wrong pass" 
-            " phrase?)"); 
-      return CURLE_SSL_CONNECT_ERROR; 
-    } 
- 
-    file_type = do_file_type(SSL_SET_OPTION(key_type)); 
-    if(SSL_CTX_use_PrivateKey_file(BACKEND->ctx, SSL_SET_OPTION(key), 
-                                    file_type) != 1) { 
-      failf(data, "unable to set private key"); 
-      return CURLE_SSL_CONNECT_ERROR; 
-    } 
-    infof(data, 
-          "client cert: %s\n", 
-          SSL_CONN_CONFIG(clientcert)? 
-          SSL_CONN_CONFIG(clientcert): "none"); 
-  } 
- 
+      failf(data, "unable to use client certificate (no key or wrong pass"
+            " phrase?)");
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+
+    file_type = do_file_type(SSL_SET_OPTION(key_type));
+    if(SSL_CTX_use_PrivateKey_file(BACKEND->ctx, SSL_SET_OPTION(key),
+                                    file_type) != 1) {
+      failf(data, "unable to set private key");
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+    infof(data,
+          "client cert: %s\n",
+          SSL_CONN_CONFIG(clientcert)?
+          SSL_CONN_CONFIG(clientcert): "none");
+  }
+
   ciphers = SSL_CONN_CONFIG(cipher_list);
   if(ciphers) {
 #ifdef MESALINK_HAVE_CIPHER
@@ -301,12 +301,12 @@ mesalink_connect_step2(struct connectdata *conn, int sockindex)
   if(ret != SSL_SUCCESS) {
     int detail = SSL_get_error(BACKEND->handle, ret);
 
-    if(SSL_ERROR_WANT_CONNECT == detail || SSL_ERROR_WANT_READ == detail) { 
+    if(SSL_ERROR_WANT_CONNECT == detail || SSL_ERROR_WANT_READ == detail) {
       connssl->connecting_state = ssl_connect_2_reading;
       return CURLE_OK;
     }
     else {
-      char error_buffer[MESALINK_MAX_ERROR_SZ]; 
+      char error_buffer[MESALINK_MAX_ERROR_SZ];
       failf(data,
             "SSL_connect failed with error %d: %s",
             detail,
diff --git a/contrib/libs/curl/lib/vtls/nss.c b/contrib/libs/curl/lib/vtls/nss.c
index c2fab14914..59649ccc3a 100644
--- a/contrib/libs/curl/lib/vtls/nss.c
+++ b/contrib/libs/curl/lib/vtls/nss.c
@@ -38,7 +38,7 @@
 #include "select.h"
 #include "vtls.h"
 #include "llist.h"
-#include "multiif.h" 
+#include "multiif.h"
 #include "curl_printf.h"
 #include "nssg.h"
 #include <nspr.h>
@@ -214,19 +214,19 @@ static const struct cipher_s cipherlist[] = {
  {"dhe_rsa_chacha20_poly1305_sha_256",
      TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256},
 #endif
-#ifdef TLS_AES_256_GCM_SHA384 
- {"aes_128_gcm_sha_256",              TLS_AES_128_GCM_SHA256}, 
- {"aes_256_gcm_sha_384",              TLS_AES_256_GCM_SHA384}, 
- {"chacha20_poly1305_sha_256",        TLS_CHACHA20_POLY1305_SHA256}, 
-#endif 
+#ifdef TLS_AES_256_GCM_SHA384
+ {"aes_128_gcm_sha_256",              TLS_AES_128_GCM_SHA256},
+ {"aes_256_gcm_sha_384",              TLS_AES_256_GCM_SHA384},
+ {"chacha20_poly1305_sha_256",        TLS_CHACHA20_POLY1305_SHA256},
+#endif
 };
 
-#if defined(WIN32) 
+#if defined(WIN32)
 static const char *pem_library = "nsspem.dll";
 static const char *trust_library = "nssckbi.dll";
-#elif defined(__APPLE__) 
-static const char *pem_library = "libnsspem.dylib"; 
-static const char *trust_library = "libnssckbi.dylib"; 
+#elif defined(__APPLE__)
+static const char *pem_library = "libnsspem.dylib";
+static const char *trust_library = "libnssckbi.dylib";
 #else
 static const char *pem_library = "libnsspem.so";
 static const char *trust_library = "libnssckbi.so";
@@ -384,7 +384,7 @@ static int is_file(const char *filename)
     return 0;
 
   if(stat(filename, &st) == 0)
-    if(S_ISREG(st.st_mode) || S_ISFIFO(st.st_mode) || S_ISCHR(st.st_mode)) 
+    if(S_ISREG(st.st_mode) || S_ISFIFO(st.st_mode) || S_ISCHR(st.st_mode))
       return 1;
 
   return 0;
@@ -580,19 +580,19 @@ static CURLcode nss_cache_crl(SECItem *crl_der)
   /* acquire lock before call of CERT_CacheCRL() and accessing nss_crl_list */
   PR_Lock(nss_crllock);
 
-  if(SECSuccess != CERT_CacheCRL(db, crl_der)) { 
-    /* unable to cache CRL */ 
+  if(SECSuccess != CERT_CacheCRL(db, crl_der)) {
+    /* unable to cache CRL */
     SECITEM_FreeItem(crl_der, PR_TRUE);
     PR_Unlock(nss_crllock);
-    return CURLE_SSL_CRL_BADFILE; 
+    return CURLE_SSL_CRL_BADFILE;
   }
 
-  /* store the CRL item so that we can free it in Curl_nss_cleanup() */ 
-  if(insert_wrapped_ptr(&nss_crl_list, crl_der) != CURLE_OK) { 
-    if(SECSuccess == CERT_UncacheCRL(db, crl_der)) 
-      SECITEM_FreeItem(crl_der, PR_TRUE); 
+  /* store the CRL item so that we can free it in Curl_nss_cleanup() */
+  if(insert_wrapped_ptr(&nss_crl_list, crl_der) != CURLE_OK) {
+    if(SECSuccess == CERT_UncacheCRL(db, crl_der))
+      SECITEM_FreeItem(crl_der, PR_TRUE);
     PR_Unlock(nss_crllock);
-    return CURLE_OUT_OF_MEMORY; 
+    return CURLE_OUT_OF_MEMORY;
   }
 
   /* we need to clear session cache, so that the CRL could take effect */
@@ -690,10 +690,10 @@ static CURLcode nss_load_key(struct connectdata *conn, int sockindex,
   tmp = SECMOD_WaitForAnyTokenEvent(pem_module, 0, 0);
   if(tmp)
     PK11_FreeSlot(tmp);
-  if(!PK11_IsPresent(slot)) { 
-    PK11_FreeSlot(slot); 
-    return CURLE_SSL_CERTPROBLEM; 
-  } 
+  if(!PK11_IsPresent(slot)) {
+    PK11_FreeSlot(slot);
+    return CURLE_SSL_CERTPROBLEM;
+  }
 
   status = PK11_Authenticate(slot, PR_TRUE, SSL_SET_OPTION(key_passwd));
   PK11_FreeSlot(slot);
@@ -856,8 +856,8 @@ static void HandshakeCallback(PRFileDesc *sock, void *arg)
        !memcmp(ALPN_HTTP_1_1, buf, ALPN_HTTP_1_1_LENGTH)) {
       conn->negnpn = CURL_HTTP_VERSION_1_1;
     }
-    Curl_multiuse_state(conn, conn->negnpn == CURL_HTTP_VERSION_2 ? 
-                        BUNDLE_MULTIPLEX : BUNDLE_NO_MULTIUSE); 
+    Curl_multiuse_state(conn, conn->negnpn == CURL_HTTP_VERSION_2 ?
+                        BUNDLE_MULTIPLEX : BUNDLE_NO_MULTIUSE);
   }
 }
 
@@ -1319,8 +1319,8 @@ static void nss_unload_module(SECMODModule **pmod)
 static CURLcode nss_init_core(struct Curl_easy *data, const char *cert_dir)
 {
   NSSInitParameters initparams;
-  PRErrorCode err; 
-  const char *err_name; 
+  PRErrorCode err;
+  const char *err_name;
 
   if(nss_context != NULL)
     return CURLE_OK;
@@ -1341,9 +1341,9 @@ static CURLcode nss_init_core(struct Curl_easy *data, const char *cert_dir)
     if(nss_context != NULL)
       return CURLE_OK;
 
-    err = PR_GetError(); 
-    err_name = nss_error_to_name(err); 
-    infof(data, "Unable to initialize NSS database: %d (%s)\n", err, err_name); 
+    err = PR_GetError();
+    err_name = nss_error_to_name(err);
+    infof(data, "Unable to initialize NSS database: %d (%s)\n", err, err_name);
   }
 
   infof(data, "Initializing NSS with certpath: none\n");
@@ -1353,9 +1353,9 @@ static CURLcode nss_init_core(struct Curl_easy *data, const char *cert_dir)
   if(nss_context != NULL)
     return CURLE_OK;
 
-  err = PR_GetError(); 
-  err_name = nss_error_to_name(err); 
-  failf(data, "Unable to initialize NSS: %d (%s)", err, err_name); 
+  err = PR_GetError();
+  err_name = nss_error_to_name(err);
+  failf(data, "Unable to initialize NSS: %d (%s)", err, err_name);
   return CURLE_SSL_CACERT_BADFILE;
 }
 
@@ -1427,7 +1427,7 @@ static int Curl_nss_init(void)
 {
   /* curl_global_init() is not thread-safe so this test is ok */
   if(nss_initlock == NULL) {
-    PR_Init(PR_USER_THREAD, PR_PRIORITY_NORMAL, 0); 
+    PR_Init(PR_USER_THREAD, PR_PRIORITY_NORMAL, 0);
     nss_initlock = PR_NewLock();
     nss_crllock = PR_NewLock();
     nss_findslot_lock = PR_NewLock();
@@ -1743,16 +1743,16 @@ static CURLcode nss_init_sslver(SSLVersionRange *sslver,
   CURLcode result;
   const long min = SSL_CONN_CONFIG(version);
   const long max = SSL_CONN_CONFIG(version_max);
-  SSLVersionRange vrange; 
+  SSLVersionRange vrange;
 
   switch(min) {
   case CURL_SSLVERSION_TLSv1:
   case CURL_SSLVERSION_DEFAULT:
-    /* Bump our minimum TLS version if NSS has stricter requirements. */ 
-    if(SSL_VersionRangeGetDefault(ssl_variant_stream, &vrange) != SECSuccess) 
-      return CURLE_SSL_CONNECT_ERROR; 
-    if(sslver->min < vrange.min) 
-      sslver->min = vrange.min; 
+    /* Bump our minimum TLS version if NSS has stricter requirements. */
+    if(SSL_VersionRangeGetDefault(ssl_variant_stream, &vrange) != SECSuccess)
+      return CURLE_SSL_CONNECT_ERROR;
+    if(sslver->min < vrange.min)
+      sslver->min = vrange.min;
     break;
   default:
     result = nss_sslver_from_curl(&sslver->min, min);
diff --git a/contrib/libs/curl/lib/vtls/openssl.c b/contrib/libs/curl/lib/vtls/openssl.c
index c154398027..e9c535f8f4 100644
--- a/contrib/libs/curl/lib/vtls/openssl.c
+++ b/contrib/libs/curl/lib/vtls/openssl.c
@@ -56,7 +56,7 @@
 #include "keylog.h"
 #include "strcase.h"
 #include "hostcheck.h"
-#include "multiif.h" 
+#include "multiif.h"
 #include "strerror.h"
 #include "curl_printf.h"
 
@@ -76,16 +76,16 @@
 #include <openssl/buffer.h>
 #include <openssl/pkcs12.h>
 
-#ifdef USE_AMISSL 
-#include "amigaos.h" 
-#endif 
- 
+#ifdef USE_AMISSL
+#include "amigaos.h"
+#endif
+
 #if (OPENSSL_VERSION_NUMBER >= 0x0090808fL) && !defined(OPENSSL_NO_OCSP)
 #include <openssl/ocsp.h>
 #endif
 
 #if (OPENSSL_VERSION_NUMBER >= 0x0090700fL) && /* 0.9.7 or later */     \
-  !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_UI_CONSOLE) 
+  !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_UI_CONSOLE)
 #define USE_OPENSSL_ENGINE
 #include <openssl/engine.h>
 #endif
@@ -162,10 +162,10 @@
 #define HAVE_X509_GET0_SIGNATURE 1
 #endif
 
-#if (OPENSSL_VERSION_NUMBER >= 0x1000200fL) /* 1.0.2 or later */ 
-#define HAVE_SSL_GET_SHUTDOWN 1 
-#endif 
- 
+#if (OPENSSL_VERSION_NUMBER >= 0x1000200fL) /* 1.0.2 or later */
+#define HAVE_SSL_GET_SHUTDOWN 1
+#endif
+
 #if OPENSSL_VERSION_NUMBER >= 0x10002003L && \
   OPENSSL_VERSION_NUMBER <= 0x10002FFFL && \
   !defined(OPENSSL_NO_COMP)
@@ -348,11 +348,11 @@ static char *ossl_strerror(unsigned long error, char *buf, size_t size)
   if(size)
     *buf = '\0';
 
-#ifdef OPENSSL_IS_BORINGSSL 
-  ERR_error_string_n((uint32_t)error, buf, size); 
-#else 
+#ifdef OPENSSL_IS_BORINGSSL
+  ERR_error_string_n((uint32_t)error, buf, size);
+#else
   ERR_error_string_n(error, buf, size);
-#endif 
+#endif
 
   if(size > 1 && !*buf) {
     strncpy(buf, (error ? "Unknown error" : "No error"), size);
@@ -927,11 +927,11 @@ int cert_stuff(struct connectdata *conn,
   fail:
       EVP_PKEY_free(pri);
       X509_free(x509);
-#ifdef USE_AMISSL 
-      sk_X509_pop_free(ca, Curl_amiga_X509_free); 
-#else 
+#ifdef USE_AMISSL
+      sk_X509_pop_free(ca, Curl_amiga_X509_free);
+#else
       sk_X509_pop_free(ca, X509_free);
-#endif 
+#endif
       if(!cert_done)
         return 0; /* failure! */
       break;
@@ -942,11 +942,11 @@ int cert_stuff(struct connectdata *conn,
     }
 
     if((!key_file) && (!key_bio)) {
-      key_file = cert_file; 
+      key_file = cert_file;
       key_bio = cert_bio;
     }
-    else 
-      file_type = do_file_type(key_type); 
+    else
+      file_type = do_file_type(key_type);
 
     switch(file_type) {
     case SSL_FILETYPE_PEM:
@@ -1136,8 +1136,8 @@ static int Curl_ossl_init(void)
   ENGINE_load_builtin_engines();
 #endif
 
-/* CONF_MFLAGS_DEFAULT_SECTION was introduced some time between 0.9.8b and 
-   0.9.8e */ 
+/* CONF_MFLAGS_DEFAULT_SECTION was introduced some time between 0.9.8b and
+   0.9.8e */
 #ifndef CONF_MFLAGS_DEFAULT_SECTION
 #define CONF_MFLAGS_DEFAULT_SECTION 0x0
 #endif
@@ -1391,7 +1391,7 @@ static int Curl_ossl_shutdown(struct connectdata *conn, int sockindex)
   bool done = FALSE;
   struct ssl_backend_data *backend = connssl->backend;
 
-#ifndef CURL_DISABLE_FTP 
+#ifndef CURL_DISABLE_FTP
   /* This has only been tested on the proftpd server, and the mod_tls code
      sends a close notify alert without waiting for a close notify alert in
      response. Thus we wait for a close notify alert from the server, but
@@ -1399,7 +1399,7 @@ static int Curl_ossl_shutdown(struct connectdata *conn, int sockindex)
 
   if(data->set.ftp_ccc == CURLFTPSSL_CCC_ACTIVE)
       (void)SSL_shutdown(backend->handle);
-#endif 
+#endif
 
   if(backend->handle) {
     buffsize = (int)sizeof(buf);
@@ -1617,13 +1617,13 @@ static CURLcode verifyhost(struct connectdata *conn, X509 *server_cert)
   altnames = X509_get_ext_d2i(server_cert, NID_subject_alt_name, NULL, NULL);
 
   if(altnames) {
-#ifdef OPENSSL_IS_BORINGSSL 
-    size_t numalts; 
-    size_t i; 
-#else 
+#ifdef OPENSSL_IS_BORINGSSL
+    size_t numalts;
+    size_t i;
+#else
     int numalts;
     int i;
-#endif 
+#endif
     bool dnsmatched = FALSE;
     bool ipmatched = FALSE;
 
@@ -1653,9 +1653,9 @@ static CURLcode verifyhost(struct connectdata *conn, X509 *server_cert)
              assumed that the data returned by ASN1_STRING_data() is null
              terminated or does not contain embedded nulls." But also that
              "The actual format of the data will depend on the actual string
-             type itself: for example for an IA5String the data will be ASCII" 
+             type itself: for example for an IA5String the data will be ASCII"
 
-             It has been however verified that in 0.9.6 and 0.9.7, IA5String 
+             It has been however verified that in 0.9.6 and 0.9.7, IA5String
              is always null-terminated.
           */
           if((altlen == strlen(altptr)) &&
@@ -1720,7 +1720,7 @@ static CURLcode verifyhost(struct connectdata *conn, X509 *server_cert)
       /* In OpenSSL 0.9.7d and earlier, ASN1_STRING_to_UTF8 fails if the input
          is already UTF-8 encoded. We check for this case and copy the raw
          string manually to avoid the problem. This code can be made
-         conditional in the future when OpenSSL has been fixed. */ 
+         conditional in the future when OpenSSL has been fixed. */
       if(tmp) {
         if(ASN1_STRING_type(tmp) == V_ASN1_UTF8STRING) {
           j = ASN1_STRING_length(tmp);
@@ -1786,7 +1786,7 @@ static CURLcode verifystatus(struct connectdata *conn,
                              struct ssl_connect_data *connssl)
 {
   int i, ocsp_status;
-  unsigned char *status; 
+  unsigned char *status;
   const unsigned char *p;
   CURLcode result = CURLE_OK;
   struct Curl_easy *data = conn->data;
@@ -1803,12 +1803,12 @@ static CURLcode verifystatus(struct connectdata *conn,
 
   long len = SSL_get_tlsext_status_ocsp_resp(backend->handle, &status);
 
-  if(!status) { 
+  if(!status) {
     failf(data, "No OCSP response received");
     result = CURLE_SSL_INVALIDCERTSTATUS;
     goto end;
   }
-  p = status; 
+  p = status;
   rsp = d2i_OCSP_RESPONSE(NULL, &p, len);
   if(!rsp) {
     failf(data, "Invalid OCSP response");
@@ -2266,101 +2266,101 @@ get_ssl_version_txt(SSL *ssl)
 }
 #endif
 
-#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) /* 1.1.0 */ 
+#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) /* 1.1.0 */
 static CURLcode
-set_ssl_version_min_max(SSL_CTX *ctx, struct connectdata *conn) 
+set_ssl_version_min_max(SSL_CTX *ctx, struct connectdata *conn)
 {
-  /* first, TLS min version... */ 
-  long curl_ssl_version_min = SSL_CONN_CONFIG(version); 
-  long curl_ssl_version_max; 
- 
-  /* convert cURL min SSL version option to OpenSSL constant */ 
+  /* first, TLS min version... */
+  long curl_ssl_version_min = SSL_CONN_CONFIG(version);
+  long curl_ssl_version_max;
+
+  /* convert cURL min SSL version option to OpenSSL constant */
 #if defined(OPENSSL_IS_BORINGSSL) || defined(LIBRESSL_VERSION_NUMBER)
   uint16_t ossl_ssl_version_min = 0;
   uint16_t ossl_ssl_version_max = 0;
 #else
-  long ossl_ssl_version_min = 0; 
-  long ossl_ssl_version_max = 0; 
-#endif
-  switch(curl_ssl_version_min) { 
-    case CURL_SSLVERSION_TLSv1: /* TLS 1.x */ 
-    case CURL_SSLVERSION_TLSv1_0: 
-      ossl_ssl_version_min = TLS1_VERSION; 
-      break; 
-    case CURL_SSLVERSION_TLSv1_1: 
-      ossl_ssl_version_min = TLS1_1_VERSION; 
-      break; 
-    case CURL_SSLVERSION_TLSv1_2: 
-      ossl_ssl_version_min = TLS1_2_VERSION; 
-      break; 
-#ifdef TLS1_3_VERSION 
-    case CURL_SSLVERSION_TLSv1_3: 
-      ossl_ssl_version_min = TLS1_3_VERSION; 
-      break; 
-#endif 
-  } 
- 
-  /* CURL_SSLVERSION_DEFAULT means that no option was selected. 
+  long ossl_ssl_version_min = 0;
+  long ossl_ssl_version_max = 0;
+#endif
+  switch(curl_ssl_version_min) {
+    case CURL_SSLVERSION_TLSv1: /* TLS 1.x */
+    case CURL_SSLVERSION_TLSv1_0:
+      ossl_ssl_version_min = TLS1_VERSION;
+      break;
+    case CURL_SSLVERSION_TLSv1_1:
+      ossl_ssl_version_min = TLS1_1_VERSION;
+      break;
+    case CURL_SSLVERSION_TLSv1_2:
+      ossl_ssl_version_min = TLS1_2_VERSION;
+      break;
+#ifdef TLS1_3_VERSION
+    case CURL_SSLVERSION_TLSv1_3:
+      ossl_ssl_version_min = TLS1_3_VERSION;
+      break;
+#endif
+  }
+
+  /* CURL_SSLVERSION_DEFAULT means that no option was selected.
      We don't want to pass 0 to SSL_CTX_set_min_proto_version as
      it would enable all versions down to the lowest supported by
      the library.
      So we skip this, and stay with the OS default
-  */ 
-  if(curl_ssl_version_min != CURL_SSLVERSION_DEFAULT) { 
-    if(!SSL_CTX_set_min_proto_version(ctx, ossl_ssl_version_min)) { 
-      return CURLE_SSL_CONNECT_ERROR; 
-    } 
-  } 
- 
-  /* ... then, TLS max version */ 
-  curl_ssl_version_max = SSL_CONN_CONFIG(version_max); 
- 
-  /* convert cURL max SSL version option to OpenSSL constant */ 
-  switch(curl_ssl_version_max) { 
-    case CURL_SSLVERSION_MAX_TLSv1_0: 
-      ossl_ssl_version_max = TLS1_VERSION; 
-      break; 
-    case CURL_SSLVERSION_MAX_TLSv1_1: 
-      ossl_ssl_version_max = TLS1_1_VERSION; 
-      break; 
-    case CURL_SSLVERSION_MAX_TLSv1_2: 
-      ossl_ssl_version_max = TLS1_2_VERSION; 
-      break; 
-#ifdef TLS1_3_VERSION 
-    case CURL_SSLVERSION_MAX_TLSv1_3: 
-      ossl_ssl_version_max = TLS1_3_VERSION; 
-      break; 
-#endif 
-    case CURL_SSLVERSION_MAX_NONE:  /* none selected */ 
-    case CURL_SSLVERSION_MAX_DEFAULT:  /* max selected */ 
-    default: 
-      /* SSL_CTX_set_max_proto_version states that: 
-        setting the maximum to 0 will enable 
-        protocol versions up to the highest version 
-        supported by the library */ 
-      ossl_ssl_version_max = 0; 
-      break; 
-  } 
- 
-  if(!SSL_CTX_set_max_proto_version(ctx, ossl_ssl_version_max)) { 
-    return CURLE_SSL_CONNECT_ERROR; 
-  } 
- 
-  return CURLE_OK; 
-} 
-#endif 
- 
-#ifdef OPENSSL_IS_BORINGSSL 
-typedef uint32_t ctx_option_t; 
-#else 
-typedef long ctx_option_t; 
-#endif 
- 
-#if (OPENSSL_VERSION_NUMBER < 0x10100000L) /* 1.1.0 */ 
-static CURLcode 
-set_ssl_version_min_max_legacy(ctx_option_t *ctx_options, 
-                              struct connectdata *conn, int sockindex) 
-{ 
+  */
+  if(curl_ssl_version_min != CURL_SSLVERSION_DEFAULT) {
+    if(!SSL_CTX_set_min_proto_version(ctx, ossl_ssl_version_min)) {
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+  }
+
+  /* ... then, TLS max version */
+  curl_ssl_version_max = SSL_CONN_CONFIG(version_max);
+
+  /* convert cURL max SSL version option to OpenSSL constant */
+  switch(curl_ssl_version_max) {
+    case CURL_SSLVERSION_MAX_TLSv1_0:
+      ossl_ssl_version_max = TLS1_VERSION;
+      break;
+    case CURL_SSLVERSION_MAX_TLSv1_1:
+      ossl_ssl_version_max = TLS1_1_VERSION;
+      break;
+    case CURL_SSLVERSION_MAX_TLSv1_2:
+      ossl_ssl_version_max = TLS1_2_VERSION;
+      break;
+#ifdef TLS1_3_VERSION
+    case CURL_SSLVERSION_MAX_TLSv1_3:
+      ossl_ssl_version_max = TLS1_3_VERSION;
+      break;
+#endif
+    case CURL_SSLVERSION_MAX_NONE:  /* none selected */
+    case CURL_SSLVERSION_MAX_DEFAULT:  /* max selected */
+    default:
+      /* SSL_CTX_set_max_proto_version states that:
+        setting the maximum to 0 will enable
+        protocol versions up to the highest version
+        supported by the library */
+      ossl_ssl_version_max = 0;
+      break;
+  }
+
+  if(!SSL_CTX_set_max_proto_version(ctx, ossl_ssl_version_max)) {
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+
+  return CURLE_OK;
+}
+#endif
+
+#ifdef OPENSSL_IS_BORINGSSL
+typedef uint32_t ctx_option_t;
+#else
+typedef long ctx_option_t;
+#endif
+
+#if (OPENSSL_VERSION_NUMBER < 0x10100000L) /* 1.1.0 */
+static CURLcode
+set_ssl_version_min_max_legacy(ctx_option_t *ctx_options,
+                              struct connectdata *conn, int sockindex)
+{
 #if (OPENSSL_VERSION_NUMBER < 0x1000100FL) || !defined(TLS1_3_VERSION)
   /* convoluted #if condition just to avoid compiler warnings on unused
      variable */
@@ -2431,7 +2431,7 @@ set_ssl_version_min_max_legacy(ctx_option_t *ctx_options,
   }
   return CURLE_OK;
 }
-#endif 
+#endif
 
 /* The "new session" callback must return zero if the session can be removed
  * or non-zero if the session has been put into the session cache.
@@ -2498,8 +2498,8 @@ static CURLcode ossl_connect_step1(struct connectdata *conn, int sockindex)
   X509_LOOKUP *lookup = NULL;
   curl_socket_t sockfd = conn->sock[sockindex];
   struct ssl_connect_data *connssl = &conn->ssl[sockindex];
-  ctx_option_t ctx_options = 0; 
- 
+  ctx_option_t ctx_options = 0;
+
 #ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
   bool sni;
   const char * const hostname = SSL_HOST_NAME();
@@ -2663,66 +2663,66 @@ static CURLcode ossl_connect_step1(struct connectdata *conn, int sockindex)
 #endif
 
   switch(ssl_version) {
-    /* "--sslv2" option means SSLv2 only, disable all others */ 
-    case CURL_SSLVERSION_SSLv2: 
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 */ 
+    /* "--sslv2" option means SSLv2 only, disable all others */
+    case CURL_SSLVERSION_SSLv2:
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 */
       SSL_CTX_set_min_proto_version(backend->ctx, SSL2_VERSION);
       SSL_CTX_set_max_proto_version(backend->ctx, SSL2_VERSION);
-#else 
-      ctx_options |= SSL_OP_NO_SSLv3; 
-      ctx_options |= SSL_OP_NO_TLSv1; 
-#  if OPENSSL_VERSION_NUMBER >= 0x1000100FL 
-      ctx_options |= SSL_OP_NO_TLSv1_1; 
-      ctx_options |= SSL_OP_NO_TLSv1_2; 
-#    ifdef TLS1_3_VERSION 
-      ctx_options |= SSL_OP_NO_TLSv1_3; 
-#    endif 
-#  endif 
-#endif
-      break; 
- 
-    /* "--sslv3" option means SSLv3 only, disable all others */ 
-    case CURL_SSLVERSION_SSLv3: 
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 */ 
+#else
+      ctx_options |= SSL_OP_NO_SSLv3;
+      ctx_options |= SSL_OP_NO_TLSv1;
+#  if OPENSSL_VERSION_NUMBER >= 0x1000100FL
+      ctx_options |= SSL_OP_NO_TLSv1_1;
+      ctx_options |= SSL_OP_NO_TLSv1_2;
+#    ifdef TLS1_3_VERSION
+      ctx_options |= SSL_OP_NO_TLSv1_3;
+#    endif
+#  endif
+#endif
+      break;
+
+    /* "--sslv3" option means SSLv3 only, disable all others */
+    case CURL_SSLVERSION_SSLv3:
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 */
       SSL_CTX_set_min_proto_version(backend->ctx, SSL3_VERSION);
       SSL_CTX_set_max_proto_version(backend->ctx, SSL3_VERSION);
-#else 
-      ctx_options |= SSL_OP_NO_SSLv2; 
-      ctx_options |= SSL_OP_NO_TLSv1; 
-#  if OPENSSL_VERSION_NUMBER >= 0x1000100FL 
-      ctx_options |= SSL_OP_NO_TLSv1_1; 
-      ctx_options |= SSL_OP_NO_TLSv1_2; 
-#    ifdef TLS1_3_VERSION 
-      ctx_options |= SSL_OP_NO_TLSv1_3; 
-#    endif 
-#  endif 
-#endif
-      break; 
-
-    /* "--tlsv<x.y>" options mean TLS >= version <x.y> */ 
-    case CURL_SSLVERSION_DEFAULT: 
-    case CURL_SSLVERSION_TLSv1: /* TLS >= version 1.0 */ 
-    case CURL_SSLVERSION_TLSv1_0: /* TLS >= version 1.0 */ 
-    case CURL_SSLVERSION_TLSv1_1: /* TLS >= version 1.1 */ 
-    case CURL_SSLVERSION_TLSv1_2: /* TLS >= version 1.2 */ 
-    case CURL_SSLVERSION_TLSv1_3: /* TLS >= version 1.3 */ 
-      /* asking for any TLS version as the minimum, means no SSL versions 
-        allowed */ 
-      ctx_options |= SSL_OP_NO_SSLv2; 
-      ctx_options |= SSL_OP_NO_SSLv3; 
-
-#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) /* 1.1.0 */ 
+#else
+      ctx_options |= SSL_OP_NO_SSLv2;
+      ctx_options |= SSL_OP_NO_TLSv1;
+#  if OPENSSL_VERSION_NUMBER >= 0x1000100FL
+      ctx_options |= SSL_OP_NO_TLSv1_1;
+      ctx_options |= SSL_OP_NO_TLSv1_2;
+#    ifdef TLS1_3_VERSION
+      ctx_options |= SSL_OP_NO_TLSv1_3;
+#    endif
+#  endif
+#endif
+      break;
+
+    /* "--tlsv<x.y>" options mean TLS >= version <x.y> */
+    case CURL_SSLVERSION_DEFAULT:
+    case CURL_SSLVERSION_TLSv1: /* TLS >= version 1.0 */
+    case CURL_SSLVERSION_TLSv1_0: /* TLS >= version 1.0 */
+    case CURL_SSLVERSION_TLSv1_1: /* TLS >= version 1.1 */
+    case CURL_SSLVERSION_TLSv1_2: /* TLS >= version 1.2 */
+    case CURL_SSLVERSION_TLSv1_3: /* TLS >= version 1.3 */
+      /* asking for any TLS version as the minimum, means no SSL versions
+        allowed */
+      ctx_options |= SSL_OP_NO_SSLv2;
+      ctx_options |= SSL_OP_NO_SSLv3;
+
+#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) /* 1.1.0 */
       result = set_ssl_version_min_max(backend->ctx, conn);
-#else 
-      result = set_ssl_version_min_max_legacy(&ctx_options, conn, sockindex); 
+#else
+      result = set_ssl_version_min_max_legacy(&ctx_options, conn, sockindex);
 #endif
-      if(result != CURLE_OK) 
-        return result; 
-      break; 
+      if(result != CURLE_OK)
+        return result;
+      break;
 
-    default: 
-      failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION"); 
-      return CURLE_SSL_CONNECT_ERROR; 
+    default:
+      failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION");
+      return CURLE_SSL_CONNECT_ERROR;
   }
 
   SSL_CTX_set_options(backend->ctx, ctx_options);
@@ -3273,12 +3273,12 @@ static CURLcode ossl_connect_step2(struct connectdata *conn, int sockindex)
       connssl->connecting_state = ssl_connect_2_writing;
       return CURLE_OK;
     }
-#ifdef SSL_ERROR_WANT_ASYNC 
-    if(SSL_ERROR_WANT_ASYNC == detail) { 
-      connssl->connecting_state = ssl_connect_2; 
-      return CURLE_OK; 
-    } 
-#endif 
+#ifdef SSL_ERROR_WANT_ASYNC
+    if(SSL_ERROR_WANT_ASYNC == detail) {
+      connssl->connecting_state = ssl_connect_2;
+      return CURLE_OK;
+    }
+#endif
     else {
       /* untreated error */
       unsigned long errdetail;
@@ -3384,9 +3384,9 @@ static CURLcode ossl_connect_step2(struct connectdata *conn, int sockindex)
       }
       else
         infof(data, "ALPN, server did not agree to a protocol\n");
- 
-      Curl_multiuse_state(conn, conn->negnpn == CURL_HTTP_VERSION_2 ? 
-                          BUNDLE_MULTIPLEX : BUNDLE_NO_MULTIUSE); 
+
+      Curl_multiuse_state(conn, conn->negnpn == CURL_HTTP_VERSION_2 ?
+                          BUNDLE_MULTIPLEX : BUNDLE_NO_MULTIUSE);
     }
 #endif
 
@@ -3485,12 +3485,12 @@ static void X509V3_ext(struct Curl_easy *data,
   }
 }
 
-#ifdef OPENSSL_IS_BORINGSSL 
-typedef size_t numcert_t; 
-#else 
-typedef int numcert_t; 
-#endif 
- 
+#ifdef OPENSSL_IS_BORINGSSL
+typedef size_t numcert_t;
+#else
+typedef int numcert_t;
+#endif
+
 static CURLcode get_cert_chain(struct connectdata *conn,
                                struct ssl_connect_data *connssl)
 {
@@ -3498,7 +3498,7 @@ static CURLcode get_cert_chain(struct connectdata *conn,
   STACK_OF(X509) *sk;
   int i;
   struct Curl_easy *data = conn->data;
-  numcert_t numcerts; 
+  numcert_t numcerts;
   BIO *mem;
   struct ssl_backend_data *backend = connssl->backend;
 
@@ -3509,14 +3509,14 @@ static CURLcode get_cert_chain(struct connectdata *conn,
 
   numcerts = sk_X509_num(sk);
 
-  result = Curl_ssl_init_certinfo(data, (int)numcerts); 
+  result = Curl_ssl_init_certinfo(data, (int)numcerts);
   if(result) {
     return result;
   }
 
   mem = BIO_new(BIO_s_mem());
 
-  for(i = 0; i < (int)numcerts; i++) { 
+  for(i = 0; i < (int)numcerts; i++) {
     ASN1_INTEGER *num;
     X509 *x = sk_X509_value(sk, i);
     EVP_PKEY *pubkey = NULL;
@@ -3542,25 +3542,25 @@ static CURLcode get_cert_chain(struct connectdata *conn,
 
 #if defined(HAVE_X509_GET0_SIGNATURE) && defined(HAVE_X509_GET0_EXTENSIONS)
     {
-      const X509_ALGOR *sigalg = NULL; 
-      X509_PUBKEY *xpubkey = NULL; 
-      ASN1_OBJECT *pubkeyoid = NULL; 
-
-      X509_get0_signature(&psig, &sigalg, x); 
-      if(sigalg) { 
-        i2a_ASN1_OBJECT(mem, sigalg->algorithm); 
-        push_certinfo("Signature Algorithm", i); 
-      } 
- 
-      xpubkey = X509_get_X509_PUBKEY(x); 
-      if(xpubkey) { 
-        X509_PUBKEY_get0_param(&pubkeyoid, NULL, NULL, NULL, xpubkey); 
-        if(pubkeyoid) { 
-          i2a_ASN1_OBJECT(mem, pubkeyoid); 
+      const X509_ALGOR *sigalg = NULL;
+      X509_PUBKEY *xpubkey = NULL;
+      ASN1_OBJECT *pubkeyoid = NULL;
+
+      X509_get0_signature(&psig, &sigalg, x);
+      if(sigalg) {
+        i2a_ASN1_OBJECT(mem, sigalg->algorithm);
+        push_certinfo("Signature Algorithm", i);
+      }
+
+      xpubkey = X509_get_X509_PUBKEY(x);
+      if(xpubkey) {
+        X509_PUBKEY_get0_param(&pubkeyoid, NULL, NULL, NULL, xpubkey);
+        if(pubkeyoid) {
+          i2a_ASN1_OBJECT(mem, pubkeyoid);
           push_certinfo("Public Key Algorithm", i);
         }
       }
- 
+
       X509V3_ext(data, i, X509_get0_extensions(x));
     }
 #else
@@ -3612,7 +3612,7 @@ static CURLcode get_cert_chain(struct connectdata *conn,
           const BIGNUM *e;
 
           RSA_get0_key(rsa, &n, &e, NULL);
-          BIO_printf(mem, "%d", BN_num_bits(n)); 
+          BIO_printf(mem, "%d", BN_num_bits(n));
           push_certinfo("RSA Public Key", i);
           print_pubkey_BN(rsa, n, i);
           print_pubkey_BN(rsa, e, i);
@@ -4234,9 +4234,9 @@ static ssize_t ossl_recv(struct connectdata *conn, /* connection data */
 
     switch(err) {
     case SSL_ERROR_NONE: /* this is not an error */
-      break; 
+      break;
     case SSL_ERROR_ZERO_RETURN: /* no more data */
-      /* close_notify alert */ 
+      /* close_notify alert */
       if(num == FIRSTSOCKET)
         /* mark the connection for close if it is indeed the control
            connection */
@@ -4324,12 +4324,12 @@ static size_t Curl_ossl_version(char *buffer, size_t size)
 #endif
 #elif defined(OPENSSL_IS_BORINGSSL)
   return msnprintf(buffer, size, OSSL_PACKAGE);
-#elif defined(HAVE_OPENSSL_VERSION) && defined(OPENSSL_VERSION_STRING) 
-  return msnprintf(buffer, size, "%s/%s", 
-                   OSSL_PACKAGE, OpenSSL_version(OPENSSL_VERSION_STRING)); 
-#else 
+#elif defined(HAVE_OPENSSL_VERSION) && defined(OPENSSL_VERSION_STRING)
+  return msnprintf(buffer, size, "%s/%s",
+                   OSSL_PACKAGE, OpenSSL_version(OPENSSL_VERSION_STRING));
+#else
   /* not LibreSSL, BoringSSL and not using OpenSSL_version */
- 
+
   char sub[3];
   unsigned long ssleay_value;
   sub[2]='\0';
@@ -4355,11 +4355,11 @@ static size_t Curl_ossl_version(char *buffer, size_t size)
       sub[0]='\0';
   }
 
-  return msnprintf(buffer, size, "%s/%lx.%lx.%lx%s" 
-#ifdef OPENSSL_FIPS 
-                   "-fips" 
-#endif 
-                   , 
+  return msnprintf(buffer, size, "%s/%lx.%lx.%lx%s"
+#ifdef OPENSSL_FIPS
+                   "-fips"
+#endif
+                   ,
                    OSSL_PACKAGE,
                    (ssleay_value>>28)&0xf,
                    (ssleay_value>>20)&0xff,
diff --git a/contrib/libs/curl/lib/vtls/schannel.c b/contrib/libs/curl/lib/vtls/schannel.c
index fe0c9f1122..d7bc38917f 100644
--- a/contrib/libs/curl/lib/vtls/schannel.c
+++ b/contrib/libs/curl/lib/vtls/schannel.c
@@ -49,7 +49,7 @@
 #include "warnless.h"
 #include "x509asn1.h"
 #include "curl_printf.h"
-#include "multiif.h" 
+#include "multiif.h"
 #include "version_win32.h"
 
 /* The last #include file should be: */
@@ -316,9 +316,9 @@ get_alg_id_by_name(char *name)
 #ifdef CALG_ECDSA
   CIPHEROPTION(CALG_ECDSA);
 #endif
-#ifdef CALG_ECDH_EPHEM 
-  CIPHEROPTION(CALG_ECDH_EPHEM); 
-#endif 
+#ifdef CALG_ECDH_EPHEM
+  CIPHEROPTION(CALG_ECDH_EPHEM);
+#endif
   return 0;
 }
 
@@ -353,7 +353,7 @@ get_cert_location(TCHAR *path, DWORD *store_name, TCHAR **store_path,
                   TCHAR **thumbprint)
 {
   TCHAR *sep;
-  TCHAR *store_path_start; 
+  TCHAR *store_path_start;
   size_t store_name_len;
 
   sep = _tcschr(path, TEXT('\\'));
@@ -384,9 +384,9 @@ get_cert_location(TCHAR *path, DWORD *store_name, TCHAR **store_path,
   else
     return CURLE_SSL_CERTPROBLEM;
 
-  store_path_start = sep + 1; 
+  store_path_start = sep + 1;
 
-  sep = _tcschr(store_path_start, TEXT('\\')); 
+  sep = _tcschr(store_path_start, TEXT('\\'));
   if(sep == NULL)
     return CURLE_SSL_CERTPROBLEM;
 
@@ -394,11 +394,11 @@ get_cert_location(TCHAR *path, DWORD *store_name, TCHAR **store_path,
   if(_tcslen(*thumbprint) != CERT_THUMBPRINT_STR_LEN)
     return CURLE_SSL_CERTPROBLEM;
 
-  *sep = TEXT('\0'); 
-  *store_path = _tcsdup(store_path_start); 
-  *sep = TEXT('\\'); 
-  if(*store_path == NULL) 
-    return CURLE_OUT_OF_MEMORY; 
+  *sep = TEXT('\0');
+  *store_path = _tcsdup(store_path_start);
+  *sep = TEXT('\\');
+  if(*store_path == NULL)
+    return CURLE_OUT_OF_MEMORY;
 
   return CURLE_OK;
 }
@@ -434,9 +434,9 @@ schannel_connect_step1(struct connectdata *conn, int sockindex)
   char * const hostname = conn->host.name;
 #endif
 
-  DEBUGF(infof(data, 
-               "schannel: SSL/TLS connection with %s port %hu (step 1/3)\n", 
-               hostname, conn->remote_port)); 
+  DEBUGF(infof(data,
+               "schannel: SSL/TLS connection with %s port %hu (step 1/3)\n",
+               hostname, conn->remote_port));
 
   if(curlx_verify_windows_version(5, 1, PLATFORM_WINNT,
                                   VERSION_LESS_THAN_EQUAL)) {
@@ -496,13 +496,13 @@ schannel_connect_step1(struct connectdata *conn, int sockindex)
     Curl_ssl_sessionid_lock(conn);
     if(!Curl_ssl_getsessionid(conn, (void **)&old_cred, NULL, sockindex)) {
       BACKEND->cred = old_cred;
-      DEBUGF(infof(data, "schannel: re-using existing credential handle\n")); 
+      DEBUGF(infof(data, "schannel: re-using existing credential handle\n"));
 
       /* increment the reference counter of the credential/session handle */
       BACKEND->cred->refcount++;
-      DEBUGF(infof(data, 
-                   "schannel: incremented credential handle refcount = %d\n", 
-                   BACKEND->cred->refcount)); 
+      DEBUGF(infof(data,
+                   "schannel: incremented credential handle refcount = %d\n",
+                   BACKEND->cred->refcount));
     }
     Curl_ssl_sessionid_unlock(conn);
   }
@@ -524,8 +524,8 @@ schannel_connect_step1(struct connectdata *conn, int sockindex)
         schannel_cred.dwFlags |= SCH_CRED_IGNORE_NO_REVOCATION_CHECK |
           SCH_CRED_IGNORE_REVOCATION_OFFLINE;
 
-        DEBUGF(infof(data, "schannel: disabled server certificate revocation " 
-                     "checks\n")); 
+        DEBUGF(infof(data, "schannel: disabled server certificate revocation "
+                     "checks\n"));
       }
       else if(data->set.ssl.revoke_best_effort) {
         schannel_cred.dwFlags |= SCH_CRED_IGNORE_NO_REVOCATION_CHECK |
@@ -536,23 +536,23 @@ schannel_connect_step1(struct connectdata *conn, int sockindex)
       else {
         schannel_cred.dwFlags |= SCH_CRED_REVOCATION_CHECK_CHAIN;
 
-        DEBUGF(infof(data, 
-                     "schannel: checking server certificate revocation\n")); 
+        DEBUGF(infof(data,
+                     "schannel: checking server certificate revocation\n"));
       }
     }
     else {
       schannel_cred.dwFlags = SCH_CRED_MANUAL_CRED_VALIDATION |
         SCH_CRED_IGNORE_NO_REVOCATION_CHECK |
         SCH_CRED_IGNORE_REVOCATION_OFFLINE;
-      DEBUGF(infof(data, 
-                   "schannel: disabled server cert revocation checks\n")); 
+      DEBUGF(infof(data,
+                   "schannel: disabled server cert revocation checks\n"));
     }
 
     if(!conn->ssl_config.verifyhost) {
       schannel_cred.dwFlags |= SCH_CRED_NO_SERVERNAME_CHECK;
-      DEBUGF(infof(data, "schannel: verifyhost setting prevents Schannel from " 
-                   "comparing the supplied target name with the subject " 
-                   "names in server certificates.\n")); 
+      DEBUGF(infof(data, "schannel: verifyhost setting prevents Schannel from "
+                   "comparing the supplied target name with the subject "
+                   "names in server certificates.\n"));
     }
 
     switch(conn->ssl_config.version) {
@@ -806,9 +806,9 @@ schannel_connect_step1(struct connectdata *conn, int sockindex)
       CertFreeCertificateContext(client_certs[0]);
 
     if(sspi_status != SEC_E_OK) {
-      char buffer[STRERROR_LEN]; 
+      char buffer[STRERROR_LEN];
       failf(data, "schannel: AcquireCredentialsHandle failed: %s",
-            Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer))); 
+            Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
       Curl_safefree(BACKEND->cred);
       switch(sspi_status) {
       case SEC_E_INSUFFICIENT_MEMORY:
@@ -923,7 +923,7 @@ schannel_connect_step1(struct connectdata *conn, int sockindex)
   curlx_unicodefree(host_name);
 
   if(sspi_status != SEC_I_CONTINUE_NEEDED) {
-    char buffer[STRERROR_LEN]; 
+    char buffer[STRERROR_LEN];
     Curl_safefree(BACKEND->ctxt);
     switch(sspi_status) {
     case SEC_E_INSUFFICIENT_MEMORY:
@@ -952,8 +952,8 @@ schannel_connect_step1(struct connectdata *conn, int sockindex)
     }
   }
 
-  DEBUGF(infof(data, "schannel: sending initial handshake data: " 
-               "sending %lu bytes...\n", outbuf.cbBuffer)); 
+  DEBUGF(infof(data, "schannel: sending initial handshake data: "
+               "sending %lu bytes...\n", outbuf.cbBuffer));
 
   /* send initial handshake data which is now stored in output buffer */
   result = Curl_write_plain(conn, conn->sock[sockindex], outbuf.pvBuffer,
@@ -965,8 +965,8 @@ schannel_connect_step1(struct connectdata *conn, int sockindex)
     return CURLE_SSL_CONNECT_ERROR;
   }
 
-  DEBUGF(infof(data, "schannel: sent initial handshake data: " 
-               "sent %zd bytes\n", written)); 
+  DEBUGF(infof(data, "schannel: sent initial handshake data: "
+               "sent %zd bytes\n", written));
 
   BACKEND->recv_unrecoverable_err = CURLE_OK;
   BACKEND->recv_sspi_close_notify = false;
@@ -1004,9 +1004,9 @@ schannel_connect_step2(struct connectdata *conn, int sockindex)
 
   doread = (connssl->connecting_state != ssl_connect_2_writing) ? TRUE : FALSE;
 
-  DEBUGF(infof(data, 
-               "schannel: SSL/TLS connection with %s port %hu (step 2/3)\n", 
-               hostname, conn->remote_port)); 
+  DEBUGF(infof(data,
+               "schannel: SSL/TLS connection with %s port %hu (step 2/3)\n",
+               hostname, conn->remote_port));
 
   if(!BACKEND->cred || !BACKEND->ctxt)
     return CURLE_SSL_CONNECT_ERROR;
@@ -1038,7 +1038,7 @@ schannel_connect_step2(struct connectdata *conn, int sockindex)
   if(BACKEND->encdata_length - BACKEND->encdata_offset <
      CURL_SCHANNEL_BUFFER_FREE_SIZE) {
     /* increase internal encrypted data buffer */
-    size_t reallocated_length = BACKEND->encdata_offset + 
+    size_t reallocated_length = BACKEND->encdata_offset +
       CURL_SCHANNEL_BUFFER_FREE_SIZE;
     reallocated_buffer = realloc(BACKEND->encdata_buffer,
                                  reallocated_length);
@@ -1054,7 +1054,7 @@ schannel_connect_step2(struct connectdata *conn, int sockindex)
   }
 
   for(;;) {
-    TCHAR *host_name; 
+    TCHAR *host_name;
     if(doread) {
       /* read encrypted handshake data from socket */
       result = Curl_read_plain(conn->sock[sockindex],
@@ -1066,8 +1066,8 @@ schannel_connect_step2(struct connectdata *conn, int sockindex)
       if(result == CURLE_AGAIN) {
         if(connssl->connecting_state != ssl_connect_2_writing)
           connssl->connecting_state = ssl_connect_2_reading;
-        DEBUGF(infof(data, "schannel: failed to receive handshake, " 
-                     "need more data\n")); 
+        DEBUGF(infof(data, "schannel: failed to receive handshake, "
+                     "need more data\n"));
         return CURLE_OK;
       }
       else if((result != CURLE_OK) || (nread == 0)) {
@@ -1079,12 +1079,12 @@ schannel_connect_step2(struct connectdata *conn, int sockindex)
       /* increase encrypted data buffer offset */
       BACKEND->encdata_offset += nread;
       BACKEND->encdata_is_incomplete = false;
-      DEBUGF(infof(data, "schannel: encrypted data got %zd\n", nread)); 
+      DEBUGF(infof(data, "schannel: encrypted data got %zd\n", nread));
     }
 
-    DEBUGF(infof(data, 
-                 "schannel: encrypted data buffer: offset %zu length %zu\n", 
-                 BACKEND->encdata_offset, BACKEND->encdata_length)); 
+    DEBUGF(infof(data,
+                 "schannel: encrypted data buffer: offset %zu length %zu\n",
+                 BACKEND->encdata_offset, BACKEND->encdata_length));
 
     /* setup input buffers */
     InitSecBuffer(&inbuf[0], SECBUFFER_TOKEN, malloc(BACKEND->encdata_offset),
@@ -1127,8 +1127,8 @@ schannel_connect_step2(struct connectdata *conn, int sockindex)
     if(sspi_status == SEC_E_INCOMPLETE_MESSAGE) {
       BACKEND->encdata_is_incomplete = true;
       connssl->connecting_state = ssl_connect_2_reading;
-      DEBUGF(infof(data, 
-                   "schannel: received incomplete message, need more data\n")); 
+      DEBUGF(infof(data,
+                   "schannel: received incomplete message, need more data\n"));
       return CURLE_OK;
     }
 
@@ -1139,8 +1139,8 @@ schannel_connect_step2(struct connectdata *conn, int sockindex)
        !(BACKEND->req_flags & ISC_REQ_USE_SUPPLIED_CREDS)) {
       BACKEND->req_flags |= ISC_REQ_USE_SUPPLIED_CREDS;
       connssl->connecting_state = ssl_connect_2_writing;
-      DEBUGF(infof(data, 
-                   "schannel: a client certificate has been requested\n")); 
+      DEBUGF(infof(data,
+                   "schannel: a client certificate has been requested\n"));
       return CURLE_OK;
     }
 
@@ -1149,8 +1149,8 @@ schannel_connect_step2(struct connectdata *conn, int sockindex)
       for(i = 0; i < 3; i++) {
         /* search for handshake tokens that need to be send */
         if(outbuf[i].BufferType == SECBUFFER_TOKEN && outbuf[i].cbBuffer > 0) {
-          DEBUGF(infof(data, "schannel: sending next handshake data: " 
-                       "sending %lu bytes...\n", outbuf[i].cbBuffer)); 
+          DEBUGF(infof(data, "schannel: sending next handshake data: "
+                       "sending %lu bytes...\n", outbuf[i].cbBuffer));
 
           /* send handshake token to server */
           result = Curl_write_plain(conn, conn->sock[sockindex],
@@ -1171,7 +1171,7 @@ schannel_connect_step2(struct connectdata *conn, int sockindex)
       }
     }
     else {
-      char buffer[STRERROR_LEN]; 
+      char buffer[STRERROR_LEN];
       switch(sspi_status) {
       case SEC_E_INSUFFICIENT_MEMORY:
         failf(data, "schannel: next InitializeSecurityContext failed: %s",
@@ -1205,8 +1205,8 @@ schannel_connect_step2(struct connectdata *conn, int sockindex)
 
     /* check if there was additional remaining encrypted data */
     if(inbuf[1].BufferType == SECBUFFER_EXTRA && inbuf[1].cbBuffer > 0) {
-      DEBUGF(infof(data, "schannel: encrypted data length: %lu\n", 
-                   inbuf[1].cbBuffer)); 
+      DEBUGF(infof(data, "schannel: encrypted data length: %lu\n",
+                   inbuf[1].cbBuffer));
       /*
         There are two cases where we could be getting extra data here:
         1) If we're renegotiating a connection and the handshake is already
@@ -1245,7 +1245,7 @@ schannel_connect_step2(struct connectdata *conn, int sockindex)
   /* check if the handshake is complete */
   if(sspi_status == SEC_E_OK) {
     connssl->connecting_state = ssl_connect_3;
-    DEBUGF(infof(data, "schannel: SSL/TLS handshake complete\n")); 
+    DEBUGF(infof(data, "schannel: SSL/TLS handshake complete\n"));
   }
 
   pubkey_ptr = SSL_IS_PROXY() ?
@@ -1334,7 +1334,7 @@ schannel_connect_step3(struct connectdata *conn, int sockindex)
   struct ssl_connect_data *connssl = &conn->ssl[sockindex];
   SECURITY_STATUS sspi_status = SEC_E_OK;
   CERT_CONTEXT *ccert_context = NULL;
-#ifdef DEBUGBUILD 
+#ifdef DEBUGBUILD
   const char * const hostname = SSL_IS_PROXY() ? conn->http_proxy.host.name :
     conn->host.name;
 #endif
@@ -1344,9 +1344,9 @@ schannel_connect_step3(struct connectdata *conn, int sockindex)
 
   DEBUGASSERT(ssl_connect_3 == connssl->connecting_state);
 
-  DEBUGF(infof(data, 
-               "schannel: SSL/TLS connection with %s port %hu (step 3/3)\n", 
-               hostname, conn->remote_port)); 
+  DEBUGF(infof(data,
+               "schannel: SSL/TLS connection with %s port %hu (step 3/3)\n",
+               hostname, conn->remote_port));
 
   if(!BACKEND->cred)
     return CURLE_SSL_CONNECT_ERROR;
@@ -1400,8 +1400,8 @@ schannel_connect_step3(struct connectdata *conn, int sockindex)
     }
     else
       infof(data, "ALPN, server did not agree to a protocol\n");
-    Curl_multiuse_state(conn, conn->negnpn == CURL_HTTP_VERSION_2 ? 
-                        BUNDLE_MULTIPLEX : BUNDLE_NO_MULTIUSE); 
+    Curl_multiuse_state(conn, conn->negnpn == CURL_HTTP_VERSION_2 ?
+                        BUNDLE_MULTIPLEX : BUNDLE_NO_MULTIUSE);
   }
 #endif
 
@@ -1415,8 +1415,8 @@ schannel_connect_step3(struct connectdata *conn, int sockindex)
                                       sockindex));
     if(incache) {
       if(old_cred != BACKEND->cred) {
-        DEBUGF(infof(data, 
-                     "schannel: old credential handle is stale, removing\n")); 
+        DEBUGF(infof(data,
+                     "schannel: old credential handle is stale, removing\n"));
         /* we're not taking old_cred ownership here, no refcount++ is needed */
         Curl_ssl_delsessionid(conn, (void *)old_cred);
         incache = FALSE;
@@ -1434,8 +1434,8 @@ schannel_connect_step3(struct connectdata *conn, int sockindex)
       else {
         /* this cred session is now also referenced by sessionid cache */
         BACKEND->cred->refcount++;
-        DEBUGF(infof(data, 
-                     "schannel: stored credential handle in session cache\n")); 
+        DEBUGF(infof(data,
+                     "schannel: stored credential handle in session cache\n"));
       }
     }
     Curl_ssl_sessionid_unlock(conn);
@@ -1575,16 +1575,16 @@ schannel_connect_common(struct connectdata *conn, int sockindex,
     connssl->state = ssl_connection_complete;
     conn->recv[sockindex] = schannel_recv;
     conn->send[sockindex] = schannel_send;
- 
-#ifdef SECPKG_ATTR_ENDPOINT_BINDINGS 
-    /* When SSPI is used in combination with Schannel 
-     * we need the Schannel context to create the Schannel 
-     * binding to pass the IIS extended protection checks. 
-     * Available on Windows 7 or later. 
-     */ 
-    conn->sslContext = &BACKEND->ctxt->ctxt_handle; 
-#endif 
- 
+
+#ifdef SECPKG_ATTR_ENDPOINT_BINDINGS
+    /* When SSPI is used in combination with Schannel
+     * we need the Schannel context to create the Schannel
+     * binding to pass the IIS extended protection checks.
+     * Available on Windows 7 or later.
+     */
+    conn->sslContext = &BACKEND->ctxt->ctxt_handle;
+#endif
+
     *done = TRUE;
   }
   else
@@ -1766,7 +1766,7 @@ schannel_recv(struct connectdata *conn, int sockindex,
    * handled in the cleanup.
    */
 
-  DEBUGF(infof(data, "schannel: client wants to read %zu bytes\n", len)); 
+  DEBUGF(infof(data, "schannel: client wants to read %zu bytes\n", len));
   *err = CURLE_OK;
 
   if(len && len <= BACKEND->decdata_offset) {
@@ -1811,13 +1811,13 @@ schannel_recv(struct connectdata *conn, int sockindex,
       BACKEND->encdata_buffer = reallocated_buffer;
       BACKEND->encdata_length = reallocated_length;
       size = BACKEND->encdata_length - BACKEND->encdata_offset;
-      DEBUGF(infof(data, "schannel: encdata_buffer resized %zu\n", 
-                   BACKEND->encdata_length)); 
+      DEBUGF(infof(data, "schannel: encdata_buffer resized %zu\n",
+                   BACKEND->encdata_length));
     }
 
-    DEBUGF(infof(data, 
-                 "schannel: encrypted data buffer: offset %zu length %zu\n", 
-                 BACKEND->encdata_offset, BACKEND->encdata_length)); 
+    DEBUGF(infof(data,
+                 "schannel: encrypted data buffer: offset %zu length %zu\n",
+                 BACKEND->encdata_offset, BACKEND->encdata_length));
 
     /* read encrypted data from socket */
     *err = Curl_read_plain(conn->sock[sockindex],
@@ -1827,8 +1827,8 @@ schannel_recv(struct connectdata *conn, int sockindex,
     if(*err) {
       nread = -1;
       if(*err == CURLE_AGAIN)
-        DEBUGF(infof(data, 
-                     "schannel: Curl_read_plain returned CURLE_AGAIN\n")); 
+        DEBUGF(infof(data,
+                     "schannel: Curl_read_plain returned CURLE_AGAIN\n"));
       else if(*err == CURLE_RECV_ERROR)
         infof(data, "schannel: Curl_read_plain returned CURLE_RECV_ERROR\n");
       else
@@ -1836,18 +1836,18 @@ schannel_recv(struct connectdata *conn, int sockindex,
     }
     else if(nread == 0) {
       BACKEND->recv_connection_closed = true;
-      DEBUGF(infof(data, "schannel: server closed the connection\n")); 
+      DEBUGF(infof(data, "schannel: server closed the connection\n"));
     }
     else if(nread > 0) {
       BACKEND->encdata_offset += (size_t)nread;
       BACKEND->encdata_is_incomplete = false;
-      DEBUGF(infof(data, "schannel: encrypted data got %zd\n", nread)); 
+      DEBUGF(infof(data, "schannel: encrypted data got %zd\n", nread));
     }
   }
 
-  DEBUGF(infof(data, 
-               "schannel: encrypted data buffer: offset %zu length %zu\n", 
-               BACKEND->encdata_offset, BACKEND->encdata_length)); 
+  DEBUGF(infof(data,
+               "schannel: encrypted data buffer: offset %zu length %zu\n",
+               BACKEND->encdata_offset, BACKEND->encdata_length));
 
   /* decrypt loop */
   while(BACKEND->encdata_offset > 0 && sspi_status == SEC_E_OK &&
@@ -1875,8 +1875,8 @@ schannel_recv(struct connectdata *conn, int sockindex,
       /* check for successfully decrypted data, even before actual
          renegotiation or shutdown of the connection context */
       if(inbuf[1].BufferType == SECBUFFER_DATA) {
-        DEBUGF(infof(data, "schannel: decrypted data length: %lu\n", 
-                     inbuf[1].cbBuffer)); 
+        DEBUGF(infof(data, "schannel: decrypted data length: %lu\n",
+                     inbuf[1].cbBuffer));
 
         /* increase buffer in order to fit the received amount of data */
         size = inbuf[1].cbBuffer > CURL_SCHANNEL_BUFFER_FREE_SIZE ?
@@ -1908,16 +1908,16 @@ schannel_recv(struct connectdata *conn, int sockindex,
           BACKEND->decdata_offset += size;
         }
 
-        DEBUGF(infof(data, "schannel: decrypted data added: %zu\n", size)); 
-        DEBUGF(infof(data, 
-                     "schannel: decrypted cached: offset %zu length %zu\n", 
-                     BACKEND->decdata_offset, BACKEND->decdata_length)); 
+        DEBUGF(infof(data, "schannel: decrypted data added: %zu\n", size));
+        DEBUGF(infof(data,
+                     "schannel: decrypted cached: offset %zu length %zu\n",
+                     BACKEND->decdata_offset, BACKEND->decdata_length));
       }
 
       /* check for remaining encrypted data */
       if(inbuf[3].BufferType == SECBUFFER_EXTRA && inbuf[3].cbBuffer > 0) {
-        DEBUGF(infof(data, "schannel: encrypted data length: %lu\n", 
-                     inbuf[3].cbBuffer)); 
+        DEBUGF(infof(data, "schannel: encrypted data length: %lu\n",
+                     inbuf[3].cbBuffer));
 
         /* check if the remaining data is less than the total amount
          * and therefore begins after the already processed data
@@ -1931,9 +1931,9 @@ schannel_recv(struct connectdata *conn, int sockindex,
           BACKEND->encdata_offset = inbuf[3].cbBuffer;
         }
 
-        DEBUGF(infof(data, 
-                     "schannel: encrypted cached: offset %zu length %zu\n", 
-                     BACKEND->encdata_offset, BACKEND->encdata_length)); 
+        DEBUGF(infof(data,
+                     "schannel: encrypted cached: offset %zu length %zu\n",
+                     BACKEND->encdata_offset, BACKEND->encdata_length));
       }
       else {
         /* reset encrypted buffer offset, because there is no data remaining */
@@ -1988,26 +1988,26 @@ schannel_recv(struct connectdata *conn, int sockindex,
     }
     else {
 #ifndef CURL_DISABLE_VERBOSE_STRINGS
-      char buffer[STRERROR_LEN]; 
+      char buffer[STRERROR_LEN];
 #endif
       *err = CURLE_RECV_ERROR;
       infof(data, "schannel: failed to read data from server: %s\n",
-            Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer))); 
+            Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
       goto cleanup;
     }
   }
 
-  DEBUGF(infof(data, 
-               "schannel: encrypted data buffer: offset %zu length %zu\n", 
-               BACKEND->encdata_offset, BACKEND->encdata_length)); 
+  DEBUGF(infof(data,
+               "schannel: encrypted data buffer: offset %zu length %zu\n",
+               BACKEND->encdata_offset, BACKEND->encdata_length));
 
-  DEBUGF(infof(data, 
-               "schannel: decrypted data buffer: offset %zu length %zu\n", 
-               BACKEND->decdata_offset, BACKEND->decdata_length)); 
+  DEBUGF(infof(data,
+               "schannel: decrypted data buffer: offset %zu length %zu\n",
+               BACKEND->decdata_offset, BACKEND->decdata_length));
 
   cleanup:
   /* Warning- there is no guarantee the encdata state is valid at this point */
-  DEBUGF(infof(data, "schannel: schannel_recv cleanup\n")); 
+  DEBUGF(infof(data, "schannel: schannel_recv cleanup\n"));
 
   /* Error if the connection has closed without a close_notify.
 
@@ -2043,10 +2043,10 @@ schannel_recv(struct connectdata *conn, int sockindex,
     memmove(BACKEND->decdata_buffer, BACKEND->decdata_buffer + size,
             BACKEND->decdata_offset - size);
     BACKEND->decdata_offset -= size;
-    DEBUGF(infof(data, "schannel: decrypted data returned %zu\n", size)); 
-    DEBUGF(infof(data, 
-                 "schannel: decrypted data buffer: offset %zu length %zu\n", 
-                 BACKEND->decdata_offset, BACKEND->decdata_length)); 
+    DEBUGF(infof(data, "schannel: decrypted data returned %zu\n", size));
+    DEBUGF(infof(data,
+                 "schannel: decrypted data buffer: offset %zu length %zu\n",
+                 BACKEND->decdata_offset, BACKEND->decdata_length));
     *err = CURLE_OK;
     return (ssize_t)size;
   }
@@ -2129,8 +2129,8 @@ static int Curl_schannel_shutdown(struct connectdata *conn, int sockindex)
   char * const hostname = conn->host.name;
 #endif
 
-  DEBUGASSERT(data); 
- 
+  DEBUGASSERT(data);
+
   infof(data, "schannel: shutting down SSL/TLS connection with %s port %hu\n",
         hostname, conn->remote_port);
 
@@ -2150,11 +2150,11 @@ static int Curl_schannel_shutdown(struct connectdata *conn, int sockindex)
     sspi_status = s_pSecFn->ApplyControlToken(&BACKEND->ctxt->ctxt_handle,
                                               &BuffDesc);
 
-    if(sspi_status != SEC_E_OK) { 
-      char buffer[STRERROR_LEN]; 
+    if(sspi_status != SEC_E_OK) {
+      char buffer[STRERROR_LEN];
       failf(data, "schannel: ApplyControlToken failure: %s",
-            Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer))); 
-    } 
+            Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
+    }
 
     host_name = curlx_convert_UTF8_to_tchar(hostname);
     if(!host_name)
@@ -2196,18 +2196,18 @@ static int Curl_schannel_shutdown(struct connectdata *conn, int sockindex)
 
   /* free SSPI Schannel API security context handle */
   if(BACKEND->ctxt) {
-    DEBUGF(infof(data, "schannel: clear security context handle\n")); 
+    DEBUGF(infof(data, "schannel: clear security context handle\n"));
     s_pSecFn->DeleteSecurityContext(&BACKEND->ctxt->ctxt_handle);
     Curl_safefree(BACKEND->ctxt);
   }
 
   /* free SSPI Schannel API credential handle */
   if(BACKEND->cred) {
-    /* 
-     * When this function is called from Curl_schannel_close() the connection 
-     * might not have an associated transfer so the check for conn->data is 
-     * necessary. 
-     */ 
+    /*
+     * When this function is called from Curl_schannel_close() the connection
+     * might not have an associated transfer so the check for conn->data is
+     * necessary.
+     */
     Curl_ssl_sessionid_lock(conn);
     Curl_schannel_session_free(BACKEND->cred);
     Curl_ssl_sessionid_unlock(conn);
@@ -2244,7 +2244,7 @@ static void Curl_schannel_cleanup(void)
 
 static size_t Curl_schannel_version(char *buffer, size_t size)
 {
-  size = msnprintf(buffer, size, "Schannel"); 
+  size = msnprintf(buffer, size, "Schannel");
 
   return size;
 }
@@ -2284,21 +2284,21 @@ static CURLcode pkp_pin_peer_pubkey(struct connectdata *conn, int sockindex,
     return CURLE_OK;
 
   do {
-    SECURITY_STATUS sspi_status; 
-    const char *x509_der; 
-    DWORD x509_der_len; 
+    SECURITY_STATUS sspi_status;
+    const char *x509_der;
+    DWORD x509_der_len;
     struct Curl_X509certificate x509_parsed;
     struct Curl_asn1Element *pubkey;
 
-    sspi_status = 
-      s_pSecFn->QueryContextAttributes(&BACKEND->ctxt->ctxt_handle, 
-                                       SECPKG_ATTR_REMOTE_CERT_CONTEXT, 
-                                       &pCertContextServer); 
- 
-    if((sspi_status != SEC_E_OK) || (pCertContextServer == NULL)) { 
-      char buffer[STRERROR_LEN]; 
+    sspi_status =
+      s_pSecFn->QueryContextAttributes(&BACKEND->ctxt->ctxt_handle,
+                                       SECPKG_ATTR_REMOTE_CERT_CONTEXT,
+                                       &pCertContextServer);
+
+    if((sspi_status != SEC_E_OK) || (pCertContextServer == NULL)) {
+      char buffer[STRERROR_LEN];
       failf(data, "schannel: Failed to read remote certificate context: %s",
-            Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer))); 
+            Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
       break; /* failed */
     }
 
@@ -2335,11 +2335,11 @@ static CURLcode pkp_pin_peer_pubkey(struct connectdata *conn, int sockindex,
 }
 
 static void Curl_schannel_checksum(const unsigned char *input,
-                                   size_t inputlen, 
-                                   unsigned char *checksum, 
-                                   size_t checksumlen, 
-                                   DWORD provType, 
-                                   const unsigned int algId) 
+                                   size_t inputlen,
+                                   unsigned char *checksum,
+                                   size_t checksumlen,
+                                   DWORD provType,
+                                   const unsigned int algId)
 {
   HCRYPTPROV hProv = 0;
   HCRYPTHASH hHash = 0;
@@ -2389,9 +2389,9 @@ static CURLcode Curl_schannel_md5sum(unsigned char *input,
                                      unsigned char *md5sum,
                                      size_t md5len)
 {
-  Curl_schannel_checksum(input, inputlen, md5sum, md5len, 
-                         PROV_RSA_FULL, CALG_MD5); 
-  return CURLE_OK; 
+  Curl_schannel_checksum(input, inputlen, md5sum, md5len,
+                         PROV_RSA_FULL, CALG_MD5);
+  return CURLE_OK;
 }
 
 static CURLcode Curl_schannel_sha256sum(const unsigned char *input,
@@ -2399,9 +2399,9 @@ static CURLcode Curl_schannel_sha256sum(const unsigned char *input,
                                         unsigned char *sha256sum,
                                         size_t sha256len)
 {
-  Curl_schannel_checksum(input, inputlen, sha256sum, sha256len, 
-                         PROV_RSA_AES, CALG_SHA_256); 
-  return CURLE_OK; 
+  Curl_schannel_checksum(input, inputlen, sha256sum, sha256len,
+                         PROV_RSA_AES, CALG_SHA_256);
+  return CURLE_OK;
 }
 
 static void *Curl_schannel_get_internals(struct ssl_connect_data *connssl,
diff --git a/contrib/libs/curl/lib/vtls/schannel_verify.c b/contrib/libs/curl/lib/vtls/schannel_verify.c
index 53c7da17e1..31b3b2f02f 100644
--- a/contrib/libs/curl/lib/vtls/schannel_verify.c
+++ b/contrib/libs/curl/lib/vtls/schannel_verify.c
@@ -87,7 +87,7 @@ static CURLcode add_certs_to_store(HCERTSTORE trust_store,
   LARGE_INTEGER file_size;
   char *ca_file_buffer = NULL;
   char *current_ca_file_ptr = NULL;
-  TCHAR *ca_file_tstr = NULL; 
+  TCHAR *ca_file_tstr = NULL;
   size_t ca_file_bufsize = 0;
   DWORD total_bytes_read = 0;
   bool more_certs = 0;
@@ -96,7 +96,7 @@ static CURLcode add_certs_to_store(HCERTSTORE trust_store,
 
   ca_file_tstr = curlx_convert_UTF8_to_tchar((char *)ca_file);
   if(!ca_file_tstr) {
-    char buffer[STRERROR_LEN]; 
+    char buffer[STRERROR_LEN];
     failf(data,
           "schannel: invalid path name for CA file '%s': %s",
           ca_file,
@@ -118,7 +118,7 @@ static CURLcode add_certs_to_store(HCERTSTORE trust_store,
                               FILE_ATTRIBUTE_NORMAL,
                               NULL);
   if(ca_file_handle == INVALID_HANDLE_VALUE) {
-    char buffer[STRERROR_LEN]; 
+    char buffer[STRERROR_LEN];
     failf(data,
           "schannel: failed to open CA file '%s': %s",
           ca_file,
@@ -128,7 +128,7 @@ static CURLcode add_certs_to_store(HCERTSTORE trust_store,
   }
 
   if(!GetFileSizeEx(ca_file_handle, &file_size)) {
-    char buffer[STRERROR_LEN]; 
+    char buffer[STRERROR_LEN];
     failf(data,
           "schannel: failed to determine size of CA file '%s': %s",
           ca_file,
@@ -159,7 +159,7 @@ static CURLcode add_certs_to_store(HCERTSTORE trust_store,
 
     if(!ReadFile(ca_file_handle, ca_file_buffer + total_bytes_read,
                  bytes_to_read, &bytes_read, NULL)) {
-      char buffer[STRERROR_LEN]; 
+      char buffer[STRERROR_LEN];
       failf(data,
             "schannel: failed to read from CA file '%s': %s",
             ca_file,
@@ -222,11 +222,11 @@ static CURLcode add_certs_to_store(HCERTSTORE trust_store,
                              NULL,
                              NULL,
                              (const void **)&cert_context)) {
-          char buffer[STRERROR_LEN]; 
+          char buffer[STRERROR_LEN];
           failf(data,
                 "schannel: failed to extract certificate from CA file "
                 "'%s': %s",
-                ca_file, 
+                ca_file,
                 Curl_winapi_strerror(GetLastError(), buffer, sizeof(buffer)));
           result = CURLE_SSL_CACERT_BADFILE;
           more_certs = 0;
@@ -251,11 +251,11 @@ static CURLcode add_certs_to_store(HCERTSTORE trust_store,
                                                NULL);
             CertFreeCertificateContext(cert_context);
             if(!add_cert_result) {
-              char buffer[STRERROR_LEN]; 
+              char buffer[STRERROR_LEN];
               failf(data,
                     "schannel: failed to add certificate from CA file '%s' "
                     "to certificate store: %s",
-                    ca_file, 
+                    ca_file,
                     Curl_winapi_strerror(GetLastError(), buffer,
                                          sizeof(buffer)));
               result = CURLE_SSL_CACERT_BADFILE;
@@ -529,7 +529,7 @@ cleanup:
 
 CURLcode Curl_verify_certificate(struct connectdata *conn, int sockindex)
 {
-  SECURITY_STATUS sspi_status; 
+  SECURITY_STATUS sspi_status;
   struct Curl_easy *data = conn->data;
   struct ssl_connect_data *connssl = &conn->ssl[sockindex];
   CURLcode result = CURLE_OK;
@@ -545,15 +545,15 @@ CURLcode Curl_verify_certificate(struct connectdata *conn, int sockindex)
   const char * const conn_hostname = conn->host.name;
 #endif
 
-  sspi_status = 
-    s_pSecFn->QueryContextAttributes(&BACKEND->ctxt->ctxt_handle, 
-                                     SECPKG_ATTR_REMOTE_CERT_CONTEXT, 
-                                     &pCertContextServer); 
+  sspi_status =
+    s_pSecFn->QueryContextAttributes(&BACKEND->ctxt->ctxt_handle,
+                                     SECPKG_ATTR_REMOTE_CERT_CONTEXT,
+                                     &pCertContextServer);
 
-  if((sspi_status != SEC_E_OK) || (pCertContextServer == NULL)) { 
-    char buffer[STRERROR_LEN]; 
+  if((sspi_status != SEC_E_OK) || (pCertContextServer == NULL)) {
+    char buffer[STRERROR_LEN];
     failf(data, "schannel: Failed to read remote certificate context: %s",
-          Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer))); 
+          Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
     result = CURLE_PEER_FAILED_VERIFICATION;
   }
 
@@ -577,7 +577,7 @@ CURLcode Curl_verify_certificate(struct connectdata *conn, int sockindex)
                                   CERT_STORE_CREATE_NEW_FLAG,
                                   NULL);
       if(!trust_store) {
-        char buffer[STRERROR_LEN]; 
+        char buffer[STRERROR_LEN];
         failf(data, "schannel: failed to create certificate store: %s",
               Curl_winapi_strerror(GetLastError(), buffer, sizeof(buffer)));
         result = CURLE_SSL_CACERT_BADFILE;
@@ -605,7 +605,7 @@ CURLcode Curl_verify_certificate(struct connectdata *conn, int sockindex)
         CertCreateCertificateChainEngine(
           (CERT_CHAIN_ENGINE_CONFIG *)&engine_config, &cert_chain_engine);
       if(!create_engine_result) {
-        char buffer[STRERROR_LEN]; 
+        char buffer[STRERROR_LEN];
         failf(data,
               "schannel: failed to create certificate chain engine: %s",
               Curl_winapi_strerror(GetLastError(), buffer, sizeof(buffer)));
@@ -629,7 +629,7 @@ CURLcode Curl_verify_certificate(struct connectdata *conn, int sockindex)
                                  CERT_CHAIN_REVOCATION_CHECK_CHAIN),
                                 NULL,
                                 &pChainContext)) {
-      char buffer[STRERROR_LEN]; 
+      char buffer[STRERROR_LEN];
       failf(data, "schannel: CertGetCertificateChain failed: %s",
             Curl_winapi_strerror(GetLastError(), buffer, sizeof(buffer)));
       pChainContext = NULL;
diff --git a/contrib/libs/curl/lib/vtls/sectransp.c b/contrib/libs/curl/lib/vtls/sectransp.c
index eed4cb14a2..8ef60cb1f3 100644
--- a/contrib/libs/curl/lib/vtls/sectransp.c
+++ b/contrib/libs/curl/lib/vtls/sectransp.c
@@ -1,1145 +1,1145 @@
-/*************************************************************************** 
- *                                  _   _ ____  _ 
- *  Project                     ___| | | |  _ \| | 
- *                             / __| | | | |_) | | 
- *                            | (__| |_| |  _ <| |___ 
- *                             \___|\___/|_| \_\_____| 
- * 
- * Copyright (C) 2012 - 2017, Nick Zitzmann, <nickzman@gmail.com>. 
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) 2012 - 2017, Nick Zitzmann, <nickzman@gmail.com>.
  * Copyright (C) 2012 - 2020, Daniel Stenberg, <daniel@haxx.se>, et al.
- * 
- * This software is licensed as described in the file COPYING, which 
- * you should have received as part of this distribution. The terms 
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
  * are also available at https://curl.se/docs/copyright.html.
- * 
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell 
- * copies of the Software, and permit persons to whom the Software is 
- * furnished to do so, under the terms of the COPYING file. 
- * 
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY 
- * KIND, either express or implied. 
- * 
- ***************************************************************************/ 
- 
-/* 
- * Source file for all iOS and macOS SecureTransport-specific code for the 
- * TLS/SSL layer. No code but vtls.c should ever call or use these functions. 
- */ 
- 
-#include "curl_setup.h" 
- 
-#include "urldata.h" /* for the Curl_easy definition */ 
-#include "curl_base64.h" 
-#include "strtok.h" 
-#include "multiif.h" 
- 
-#ifdef USE_SECTRANSP 
- 
-#ifdef __clang__ 
-#pragma clang diagnostic push 
-#pragma clang diagnostic ignored "-Wtautological-pointer-compare" 
-#endif /* __clang__ */ 
- 
-#include <limits.h> 
- 
-#include <Security/Security.h> 
-/* For some reason, when building for iOS, the omnibus header above does 
- * not include SecureTransport.h as of iOS SDK 5.1. */ 
-#include <Security/SecureTransport.h> 
-#include <CoreFoundation/CoreFoundation.h> 
-#include <CommonCrypto/CommonDigest.h> 
- 
-/* The Security framework has changed greatly between iOS and different macOS 
-   versions, and we will try to support as many of them as we can (back to 
-   Leopard and iOS 5) by using macros and weak-linking. 
- 
-   In general, you want to build this using the most recent OS SDK, since some 
-   features require curl to be built against the latest SDK. TLS 1.1 and 1.2 
-   support, for instance, require the macOS 10.8 SDK or later. TLS 1.3 
-   requires the macOS 10.13 or iOS 11 SDK or later. */ 
-#if (TARGET_OS_MAC && !(TARGET_OS_EMBEDDED || TARGET_OS_IPHONE)) 
- 
-#if MAC_OS_X_VERSION_MAX_ALLOWED < 1050 
-#error "The Secure Transport back-end requires Leopard or later." 
-#endif /* MAC_OS_X_VERSION_MAX_ALLOWED < 1050 */ 
- 
-#define CURL_BUILD_IOS 0 
-#define CURL_BUILD_IOS_7 0 
-#define CURL_BUILD_IOS_9 0 
-#define CURL_BUILD_IOS_11 0 
-#define CURL_BUILD_MAC 1 
-/* This is the maximum API level we are allowed to use when building: */ 
-#define CURL_BUILD_MAC_10_5 MAC_OS_X_VERSION_MAX_ALLOWED >= 1050 
-#define CURL_BUILD_MAC_10_6 MAC_OS_X_VERSION_MAX_ALLOWED >= 1060 
-#define CURL_BUILD_MAC_10_7 MAC_OS_X_VERSION_MAX_ALLOWED >= 1070 
-#define CURL_BUILD_MAC_10_8 MAC_OS_X_VERSION_MAX_ALLOWED >= 1080 
-#define CURL_BUILD_MAC_10_9 MAC_OS_X_VERSION_MAX_ALLOWED >= 1090 
-#define CURL_BUILD_MAC_10_11 MAC_OS_X_VERSION_MAX_ALLOWED >= 101100 
-#define CURL_BUILD_MAC_10_13 MAC_OS_X_VERSION_MAX_ALLOWED >= 101300 
-/* These macros mean "the following code is present to allow runtime backward 
-   compatibility with at least this cat or earlier": 
-   (You set this at build-time using the compiler command line option 
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ ***************************************************************************/
+
+/*
+ * Source file for all iOS and macOS SecureTransport-specific code for the
+ * TLS/SSL layer. No code but vtls.c should ever call or use these functions.
+ */
+
+#include "curl_setup.h"
+
+#include "urldata.h" /* for the Curl_easy definition */
+#include "curl_base64.h"
+#include "strtok.h"
+#include "multiif.h"
+
+#ifdef USE_SECTRANSP
+
+#ifdef __clang__
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wtautological-pointer-compare"
+#endif /* __clang__ */
+
+#include <limits.h>
+
+#include <Security/Security.h>
+/* For some reason, when building for iOS, the omnibus header above does
+ * not include SecureTransport.h as of iOS SDK 5.1. */
+#include <Security/SecureTransport.h>
+#include <CoreFoundation/CoreFoundation.h>
+#include <CommonCrypto/CommonDigest.h>
+
+/* The Security framework has changed greatly between iOS and different macOS
+   versions, and we will try to support as many of them as we can (back to
+   Leopard and iOS 5) by using macros and weak-linking.
+
+   In general, you want to build this using the most recent OS SDK, since some
+   features require curl to be built against the latest SDK. TLS 1.1 and 1.2
+   support, for instance, require the macOS 10.8 SDK or later. TLS 1.3
+   requires the macOS 10.13 or iOS 11 SDK or later. */
+#if (TARGET_OS_MAC && !(TARGET_OS_EMBEDDED || TARGET_OS_IPHONE))
+
+#if MAC_OS_X_VERSION_MAX_ALLOWED < 1050
+#error "The Secure Transport back-end requires Leopard or later."
+#endif /* MAC_OS_X_VERSION_MAX_ALLOWED < 1050 */
+
+#define CURL_BUILD_IOS 0
+#define CURL_BUILD_IOS_7 0
+#define CURL_BUILD_IOS_9 0
+#define CURL_BUILD_IOS_11 0
+#define CURL_BUILD_MAC 1
+/* This is the maximum API level we are allowed to use when building: */
+#define CURL_BUILD_MAC_10_5 MAC_OS_X_VERSION_MAX_ALLOWED >= 1050
+#define CURL_BUILD_MAC_10_6 MAC_OS_X_VERSION_MAX_ALLOWED >= 1060
+#define CURL_BUILD_MAC_10_7 MAC_OS_X_VERSION_MAX_ALLOWED >= 1070
+#define CURL_BUILD_MAC_10_8 MAC_OS_X_VERSION_MAX_ALLOWED >= 1080
+#define CURL_BUILD_MAC_10_9 MAC_OS_X_VERSION_MAX_ALLOWED >= 1090
+#define CURL_BUILD_MAC_10_11 MAC_OS_X_VERSION_MAX_ALLOWED >= 101100
+#define CURL_BUILD_MAC_10_13 MAC_OS_X_VERSION_MAX_ALLOWED >= 101300
+/* These macros mean "the following code is present to allow runtime backward
+   compatibility with at least this cat or earlier":
+   (You set this at build-time using the compiler command line option
    "-mmacosx-version-min.") */
-#define CURL_SUPPORT_MAC_10_5 MAC_OS_X_VERSION_MIN_REQUIRED <= 1050 
-#define CURL_SUPPORT_MAC_10_6 MAC_OS_X_VERSION_MIN_REQUIRED <= 1060 
-#define CURL_SUPPORT_MAC_10_7 MAC_OS_X_VERSION_MIN_REQUIRED <= 1070 
-#define CURL_SUPPORT_MAC_10_8 MAC_OS_X_VERSION_MIN_REQUIRED <= 1080 
-#define CURL_SUPPORT_MAC_10_9 MAC_OS_X_VERSION_MIN_REQUIRED <= 1090 
- 
-#elif TARGET_OS_EMBEDDED || TARGET_OS_IPHONE 
-#define CURL_BUILD_IOS 1 
-#define CURL_BUILD_IOS_7 __IPHONE_OS_VERSION_MAX_ALLOWED >= 70000 
-#define CURL_BUILD_IOS_9 __IPHONE_OS_VERSION_MAX_ALLOWED >= 90000 
-#define CURL_BUILD_IOS_11 __IPHONE_OS_VERSION_MAX_ALLOWED >= 110000 
-#define CURL_BUILD_MAC 0 
-#define CURL_BUILD_MAC_10_5 0 
-#define CURL_BUILD_MAC_10_6 0 
-#define CURL_BUILD_MAC_10_7 0 
-#define CURL_BUILD_MAC_10_8 0 
-#define CURL_BUILD_MAC_10_9 0 
-#define CURL_BUILD_MAC_10_11 0 
-#define CURL_BUILD_MAC_10_13 0 
-#define CURL_SUPPORT_MAC_10_5 0 
-#define CURL_SUPPORT_MAC_10_6 0 
-#define CURL_SUPPORT_MAC_10_7 0 
-#define CURL_SUPPORT_MAC_10_8 0 
-#define CURL_SUPPORT_MAC_10_9 0 
- 
-#else 
-#error "The Secure Transport back-end requires iOS or macOS." 
-#endif /* (TARGET_OS_MAC && !(TARGET_OS_EMBEDDED || TARGET_OS_IPHONE)) */ 
- 
-#if CURL_BUILD_MAC 
-#include <sys/sysctl.h> 
-#endif /* CURL_BUILD_MAC */ 
- 
-#include "urldata.h" 
-#include "sendf.h" 
-#include "inet_pton.h" 
-#include "connect.h" 
-#include "select.h" 
-#include "vtls.h" 
-#include "sectransp.h" 
-#include "curl_printf.h" 
-#include "strdup.h" 
- 
-#include "curl_memory.h" 
-/* The last #include file should be: */ 
-#include "memdebug.h" 
- 
-/* From MacTypes.h (which we can't include because it isn't present in iOS: */ 
-#define ioErr -36 
-#define paramErr -50 
- 
-struct ssl_backend_data { 
-  SSLContextRef ssl_ctx; 
-  curl_socket_t ssl_sockfd; 
-  bool ssl_direction; /* true if writing, false if reading */ 
-  size_t ssl_write_buffered_length; 
-}; 
- 
-/* pinned public key support tests */ 
- 
-/* version 1 supports macOS 10.12+ and iOS 10+ */ 
-#if ((TARGET_OS_IPHONE && __IPHONE_OS_VERSION_MIN_REQUIRED >= 100000) || \ 
-    (!TARGET_OS_IPHONE && __MAC_OS_X_VERSION_MIN_REQUIRED  >= 101200)) 
-#define SECTRANSP_PINNEDPUBKEY_V1 1 
-#endif 
- 
-/* version 2 supports MacOSX 10.7+ */ 
-#if (!TARGET_OS_IPHONE && __MAC_OS_X_VERSION_MIN_REQUIRED >= 1070) 
-#define SECTRANSP_PINNEDPUBKEY_V2 1 
-#endif 
- 
-#if defined(SECTRANSP_PINNEDPUBKEY_V1) || defined(SECTRANSP_PINNEDPUBKEY_V2) 
-/* this backend supports CURLOPT_PINNEDPUBLICKEY */ 
-#define SECTRANSP_PINNEDPUBKEY 1 
-#endif /* SECTRANSP_PINNEDPUBKEY */ 
- 
-#ifdef SECTRANSP_PINNEDPUBKEY 
-/* both new and old APIs return rsa keys missing the spki header (not DER) */ 
-static const unsigned char rsa4096SpkiHeader[] = { 
-                                       0x30, 0x82, 0x02, 0x22, 0x30, 0x0d, 
-                                       0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 
-                                       0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 
-                                       0x00, 0x03, 0x82, 0x02, 0x0f, 0x00}; 
- 
-static const unsigned char rsa2048SpkiHeader[] = { 
-                                       0x30, 0x82, 0x01, 0x22, 0x30, 0x0d, 
-                                       0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 
-                                       0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 
-                                       0x00, 0x03, 0x82, 0x01, 0x0f, 0x00}; 
-#ifdef SECTRANSP_PINNEDPUBKEY_V1 
-/* the *new* version doesn't return DER encoded ecdsa certs like the old... */ 
-static const unsigned char ecDsaSecp256r1SpkiHeader[] = { 
-                                       0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 
-                                       0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 
-                                       0x01, 0x06, 0x08, 0x2a, 0x86, 0x48, 
-                                       0xce, 0x3d, 0x03, 0x01, 0x07, 0x03, 
-                                       0x42, 0x00}; 
- 
-static const unsigned char ecDsaSecp384r1SpkiHeader[] = { 
-                                       0x30, 0x76, 0x30, 0x10, 0x06, 0x07, 
-                                       0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 
-                                       0x01, 0x06, 0x05, 0x2b, 0x81, 0x04, 
-                                       0x00, 0x22, 0x03, 0x62, 0x00}; 
-#endif /* SECTRANSP_PINNEDPUBKEY_V1 */ 
-#endif /* SECTRANSP_PINNEDPUBKEY */ 
- 
-/* The following two functions were ripped from Apple sample code, 
- * with some modifications: */ 
-static OSStatus SocketRead(SSLConnectionRef connection, 
-                           void *data,          /* owned by 
-                                                 * caller, data 
-                                                 * RETURNED */ 
-                           size_t *dataLength)  /* IN/OUT */ 
-{ 
-  size_t bytesToGo = *dataLength; 
-  size_t initLen = bytesToGo; 
-  UInt8 *currData = (UInt8 *)data; 
-  /*int sock = *(int *)connection;*/ 
-  struct ssl_connect_data *connssl = (struct ssl_connect_data *)connection; 
+#define CURL_SUPPORT_MAC_10_5 MAC_OS_X_VERSION_MIN_REQUIRED <= 1050
+#define CURL_SUPPORT_MAC_10_6 MAC_OS_X_VERSION_MIN_REQUIRED <= 1060
+#define CURL_SUPPORT_MAC_10_7 MAC_OS_X_VERSION_MIN_REQUIRED <= 1070
+#define CURL_SUPPORT_MAC_10_8 MAC_OS_X_VERSION_MIN_REQUIRED <= 1080
+#define CURL_SUPPORT_MAC_10_9 MAC_OS_X_VERSION_MIN_REQUIRED <= 1090
+
+#elif TARGET_OS_EMBEDDED || TARGET_OS_IPHONE
+#define CURL_BUILD_IOS 1
+#define CURL_BUILD_IOS_7 __IPHONE_OS_VERSION_MAX_ALLOWED >= 70000
+#define CURL_BUILD_IOS_9 __IPHONE_OS_VERSION_MAX_ALLOWED >= 90000
+#define CURL_BUILD_IOS_11 __IPHONE_OS_VERSION_MAX_ALLOWED >= 110000
+#define CURL_BUILD_MAC 0
+#define CURL_BUILD_MAC_10_5 0
+#define CURL_BUILD_MAC_10_6 0
+#define CURL_BUILD_MAC_10_7 0
+#define CURL_BUILD_MAC_10_8 0
+#define CURL_BUILD_MAC_10_9 0
+#define CURL_BUILD_MAC_10_11 0
+#define CURL_BUILD_MAC_10_13 0
+#define CURL_SUPPORT_MAC_10_5 0
+#define CURL_SUPPORT_MAC_10_6 0
+#define CURL_SUPPORT_MAC_10_7 0
+#define CURL_SUPPORT_MAC_10_8 0
+#define CURL_SUPPORT_MAC_10_9 0
+
+#else
+#error "The Secure Transport back-end requires iOS or macOS."
+#endif /* (TARGET_OS_MAC && !(TARGET_OS_EMBEDDED || TARGET_OS_IPHONE)) */
+
+#if CURL_BUILD_MAC
+#include <sys/sysctl.h>
+#endif /* CURL_BUILD_MAC */
+
+#include "urldata.h"
+#include "sendf.h"
+#include "inet_pton.h"
+#include "connect.h"
+#include "select.h"
+#include "vtls.h"
+#include "sectransp.h"
+#include "curl_printf.h"
+#include "strdup.h"
+
+#include "curl_memory.h"
+/* The last #include file should be: */
+#include "memdebug.h"
+
+/* From MacTypes.h (which we can't include because it isn't present in iOS: */
+#define ioErr -36
+#define paramErr -50
+
+struct ssl_backend_data {
+  SSLContextRef ssl_ctx;
+  curl_socket_t ssl_sockfd;
+  bool ssl_direction; /* true if writing, false if reading */
+  size_t ssl_write_buffered_length;
+};
+
+/* pinned public key support tests */
+
+/* version 1 supports macOS 10.12+ and iOS 10+ */
+#if ((TARGET_OS_IPHONE && __IPHONE_OS_VERSION_MIN_REQUIRED >= 100000) || \
+    (!TARGET_OS_IPHONE && __MAC_OS_X_VERSION_MIN_REQUIRED  >= 101200))
+#define SECTRANSP_PINNEDPUBKEY_V1 1
+#endif
+
+/* version 2 supports MacOSX 10.7+ */
+#if (!TARGET_OS_IPHONE && __MAC_OS_X_VERSION_MIN_REQUIRED >= 1070)
+#define SECTRANSP_PINNEDPUBKEY_V2 1
+#endif
+
+#if defined(SECTRANSP_PINNEDPUBKEY_V1) || defined(SECTRANSP_PINNEDPUBKEY_V2)
+/* this backend supports CURLOPT_PINNEDPUBLICKEY */
+#define SECTRANSP_PINNEDPUBKEY 1
+#endif /* SECTRANSP_PINNEDPUBKEY */
+
+#ifdef SECTRANSP_PINNEDPUBKEY
+/* both new and old APIs return rsa keys missing the spki header (not DER) */
+static const unsigned char rsa4096SpkiHeader[] = {
+                                       0x30, 0x82, 0x02, 0x22, 0x30, 0x0d,
+                                       0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
+                                       0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05,
+                                       0x00, 0x03, 0x82, 0x02, 0x0f, 0x00};
+
+static const unsigned char rsa2048SpkiHeader[] = {
+                                       0x30, 0x82, 0x01, 0x22, 0x30, 0x0d,
+                                       0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
+                                       0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05,
+                                       0x00, 0x03, 0x82, 0x01, 0x0f, 0x00};
+#ifdef SECTRANSP_PINNEDPUBKEY_V1
+/* the *new* version doesn't return DER encoded ecdsa certs like the old... */
+static const unsigned char ecDsaSecp256r1SpkiHeader[] = {
+                                       0x30, 0x59, 0x30, 0x13, 0x06, 0x07,
+                                       0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02,
+                                       0x01, 0x06, 0x08, 0x2a, 0x86, 0x48,
+                                       0xce, 0x3d, 0x03, 0x01, 0x07, 0x03,
+                                       0x42, 0x00};
+
+static const unsigned char ecDsaSecp384r1SpkiHeader[] = {
+                                       0x30, 0x76, 0x30, 0x10, 0x06, 0x07,
+                                       0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02,
+                                       0x01, 0x06, 0x05, 0x2b, 0x81, 0x04,
+                                       0x00, 0x22, 0x03, 0x62, 0x00};
+#endif /* SECTRANSP_PINNEDPUBKEY_V1 */
+#endif /* SECTRANSP_PINNEDPUBKEY */
+
+/* The following two functions were ripped from Apple sample code,
+ * with some modifications: */
+static OSStatus SocketRead(SSLConnectionRef connection,
+                           void *data,          /* owned by
+                                                 * caller, data
+                                                 * RETURNED */
+                           size_t *dataLength)  /* IN/OUT */
+{
+  size_t bytesToGo = *dataLength;
+  size_t initLen = bytesToGo;
+  UInt8 *currData = (UInt8 *)data;
+  /*int sock = *(int *)connection;*/
+  struct ssl_connect_data *connssl = (struct ssl_connect_data *)connection;
   struct ssl_backend_data *backend = connssl->backend;
   int sock = backend->ssl_sockfd;
-  OSStatus rtn = noErr; 
-  size_t bytesRead; 
-  ssize_t rrtn; 
-  int theErr; 
- 
-  *dataLength = 0; 
- 
-  for(;;) { 
-    bytesRead = 0; 
-    rrtn = read(sock, currData, bytesToGo); 
-    if(rrtn <= 0) { 
-      /* this is guesswork... */ 
-      theErr = errno; 
-      if(rrtn == 0) { /* EOF = server hung up */ 
-        /* the framework will turn this into errSSLClosedNoNotify */ 
-        rtn = errSSLClosedGraceful; 
-      } 
-      else /* do the switch */ 
-        switch(theErr) { 
-          case ENOENT: 
-            /* connection closed */ 
-            rtn = errSSLClosedGraceful; 
-            break; 
-          case ECONNRESET: 
-            rtn = errSSLClosedAbort; 
-            break; 
-          case EAGAIN: 
-            rtn = errSSLWouldBlock; 
+  OSStatus rtn = noErr;
+  size_t bytesRead;
+  ssize_t rrtn;
+  int theErr;
+
+  *dataLength = 0;
+
+  for(;;) {
+    bytesRead = 0;
+    rrtn = read(sock, currData, bytesToGo);
+    if(rrtn <= 0) {
+      /* this is guesswork... */
+      theErr = errno;
+      if(rrtn == 0) { /* EOF = server hung up */
+        /* the framework will turn this into errSSLClosedNoNotify */
+        rtn = errSSLClosedGraceful;
+      }
+      else /* do the switch */
+        switch(theErr) {
+          case ENOENT:
+            /* connection closed */
+            rtn = errSSLClosedGraceful;
+            break;
+          case ECONNRESET:
+            rtn = errSSLClosedAbort;
+            break;
+          case EAGAIN:
+            rtn = errSSLWouldBlock;
             backend->ssl_direction = false;
-            break; 
-          default: 
-            rtn = ioErr; 
-            break; 
-        } 
-      break; 
-    } 
-    else { 
-      bytesRead = rrtn; 
-    } 
-    bytesToGo -= bytesRead; 
-    currData  += bytesRead; 
- 
-    if(bytesToGo == 0) { 
-      /* filled buffer with incoming data, done */ 
-      break; 
-    } 
-  } 
-  *dataLength = initLen - bytesToGo; 
- 
-  return rtn; 
-} 
- 
-static OSStatus SocketWrite(SSLConnectionRef connection, 
-                            const void *data, 
-                            size_t *dataLength)  /* IN/OUT */ 
-{ 
-  size_t bytesSent = 0; 
-  /*int sock = *(int *)connection;*/ 
-  struct ssl_connect_data *connssl = (struct ssl_connect_data *)connection; 
+            break;
+          default:
+            rtn = ioErr;
+            break;
+        }
+      break;
+    }
+    else {
+      bytesRead = rrtn;
+    }
+    bytesToGo -= bytesRead;
+    currData  += bytesRead;
+
+    if(bytesToGo == 0) {
+      /* filled buffer with incoming data, done */
+      break;
+    }
+  }
+  *dataLength = initLen - bytesToGo;
+
+  return rtn;
+}
+
+static OSStatus SocketWrite(SSLConnectionRef connection,
+                            const void *data,
+                            size_t *dataLength)  /* IN/OUT */
+{
+  size_t bytesSent = 0;
+  /*int sock = *(int *)connection;*/
+  struct ssl_connect_data *connssl = (struct ssl_connect_data *)connection;
   struct ssl_backend_data *backend = connssl->backend;
   int sock = backend->ssl_sockfd;
-  ssize_t length; 
-  size_t dataLen = *dataLength; 
-  const UInt8 *dataPtr = (UInt8 *)data; 
-  OSStatus ortn; 
-  int theErr; 
- 
-  *dataLength = 0; 
- 
-  do { 
-    length = write(sock, 
-                   (char *)dataPtr + bytesSent, 
-                   dataLen - bytesSent); 
-  } while((length > 0) && 
-           ( (bytesSent += length) < dataLen) ); 
- 
-  if(length <= 0) { 
-    theErr = errno; 
-    if(theErr == EAGAIN) { 
-      ortn = errSSLWouldBlock; 
+  ssize_t length;
+  size_t dataLen = *dataLength;
+  const UInt8 *dataPtr = (UInt8 *)data;
+  OSStatus ortn;
+  int theErr;
+
+  *dataLength = 0;
+
+  do {
+    length = write(sock,
+                   (char *)dataPtr + bytesSent,
+                   dataLen - bytesSent);
+  } while((length > 0) &&
+           ( (bytesSent += length) < dataLen) );
+
+  if(length <= 0) {
+    theErr = errno;
+    if(theErr == EAGAIN) {
+      ortn = errSSLWouldBlock;
       backend->ssl_direction = true;
-    } 
-    else { 
-      ortn = ioErr; 
-    } 
-  } 
-  else { 
-    ortn = noErr; 
-  } 
-  *dataLength = bytesSent; 
-  return ortn; 
-} 
- 
-#ifndef CURL_DISABLE_VERBOSE_STRINGS 
-CF_INLINE const char *SSLCipherNameForNumber(SSLCipherSuite cipher) 
-{ 
-  switch(cipher) { 
-    /* SSL version 3.0 */ 
-    case SSL_RSA_WITH_NULL_MD5: 
-      return "SSL_RSA_WITH_NULL_MD5"; 
-      break; 
-    case SSL_RSA_WITH_NULL_SHA: 
-      return "SSL_RSA_WITH_NULL_SHA"; 
-      break; 
-    case SSL_RSA_EXPORT_WITH_RC4_40_MD5: 
-      return "SSL_RSA_EXPORT_WITH_RC4_40_MD5"; 
-      break; 
-    case SSL_RSA_WITH_RC4_128_MD5: 
-      return "SSL_RSA_WITH_RC4_128_MD5"; 
-      break; 
-    case SSL_RSA_WITH_RC4_128_SHA: 
-      return "SSL_RSA_WITH_RC4_128_SHA"; 
-      break; 
-    case SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5: 
-      return "SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5"; 
-      break; 
-    case SSL_RSA_WITH_IDEA_CBC_SHA: 
-      return "SSL_RSA_WITH_IDEA_CBC_SHA"; 
-      break; 
-    case SSL_RSA_EXPORT_WITH_DES40_CBC_SHA: 
-      return "SSL_RSA_EXPORT_WITH_DES40_CBC_SHA"; 
-      break; 
-    case SSL_RSA_WITH_DES_CBC_SHA: 
-      return "SSL_RSA_WITH_DES_CBC_SHA"; 
-      break; 
-    case SSL_RSA_WITH_3DES_EDE_CBC_SHA: 
-      return "SSL_RSA_WITH_3DES_EDE_CBC_SHA"; 
-      break; 
-    case SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA: 
-      return "SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA"; 
-      break; 
-    case SSL_DH_DSS_WITH_DES_CBC_SHA: 
-      return "SSL_DH_DSS_WITH_DES_CBC_SHA"; 
-      break; 
-    case SSL_DH_DSS_WITH_3DES_EDE_CBC_SHA: 
-      return "SSL_DH_DSS_WITH_3DES_EDE_CBC_SHA"; 
-      break; 
-    case SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA: 
-      return "SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA"; 
-      break; 
-    case SSL_DH_RSA_WITH_DES_CBC_SHA: 
-      return "SSL_DH_RSA_WITH_DES_CBC_SHA"; 
-      break; 
-    case SSL_DH_RSA_WITH_3DES_EDE_CBC_SHA: 
-      return "SSL_DH_RSA_WITH_3DES_EDE_CBC_SHA"; 
-      break; 
-    case SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA: 
-      return "SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA"; 
-      break; 
-    case SSL_DHE_DSS_WITH_DES_CBC_SHA: 
-      return "SSL_DHE_DSS_WITH_DES_CBC_SHA"; 
-      break; 
-    case SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA: 
-      return "SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA"; 
-      break; 
-    case SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA: 
-      return "SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA"; 
-      break; 
-    case SSL_DHE_RSA_WITH_DES_CBC_SHA: 
-      return "SSL_DHE_RSA_WITH_DES_CBC_SHA"; 
-      break; 
-    case SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA: 
-      return "SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA"; 
-      break; 
-    case SSL_DH_anon_EXPORT_WITH_RC4_40_MD5: 
-      return "SSL_DH_anon_EXPORT_WITH_RC4_40_MD5"; 
-      break; 
-    case SSL_DH_anon_WITH_RC4_128_MD5: 
-      return "SSL_DH_anon_WITH_RC4_128_MD5"; 
-      break; 
-    case SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA: 
-      return "SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA"; 
-      break; 
-    case SSL_DH_anon_WITH_DES_CBC_SHA: 
-      return "SSL_DH_anon_WITH_DES_CBC_SHA"; 
-      break; 
-    case SSL_DH_anon_WITH_3DES_EDE_CBC_SHA: 
-      return "SSL_DH_anon_WITH_3DES_EDE_CBC_SHA"; 
-      break; 
-    case SSL_FORTEZZA_DMS_WITH_NULL_SHA: 
-      return "SSL_FORTEZZA_DMS_WITH_NULL_SHA"; 
-      break; 
-    case SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA: 
-      return "SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA"; 
-      break; 
-    /* TLS 1.0 with AES (RFC 3268) 
-       (Apparently these are used in SSLv3 implementations as well.) */ 
-    case TLS_RSA_WITH_AES_128_CBC_SHA: 
-      return "TLS_RSA_WITH_AES_128_CBC_SHA"; 
-      break; 
-    case TLS_DH_DSS_WITH_AES_128_CBC_SHA: 
-      return "TLS_DH_DSS_WITH_AES_128_CBC_SHA"; 
-      break; 
-    case TLS_DH_RSA_WITH_AES_128_CBC_SHA: 
-      return "TLS_DH_RSA_WITH_AES_128_CBC_SHA"; 
-      break; 
-    case TLS_DHE_DSS_WITH_AES_128_CBC_SHA: 
-      return "TLS_DHE_DSS_WITH_AES_128_CBC_SHA"; 
-      break; 
-    case TLS_DHE_RSA_WITH_AES_128_CBC_SHA: 
-      return "TLS_DHE_RSA_WITH_AES_128_CBC_SHA"; 
-      break; 
-    case TLS_DH_anon_WITH_AES_128_CBC_SHA: 
-      return "TLS_DH_anon_WITH_AES_128_CBC_SHA"; 
-      break; 
-    case TLS_RSA_WITH_AES_256_CBC_SHA: 
-      return "TLS_RSA_WITH_AES_256_CBC_SHA"; 
-      break; 
-    case TLS_DH_DSS_WITH_AES_256_CBC_SHA: 
-      return "TLS_DH_DSS_WITH_AES_256_CBC_SHA"; 
-      break; 
-    case TLS_DH_RSA_WITH_AES_256_CBC_SHA: 
-      return "TLS_DH_RSA_WITH_AES_256_CBC_SHA"; 
-      break; 
-    case TLS_DHE_DSS_WITH_AES_256_CBC_SHA: 
-      return "TLS_DHE_DSS_WITH_AES_256_CBC_SHA"; 
-      break; 
-    case TLS_DHE_RSA_WITH_AES_256_CBC_SHA: 
-      return "TLS_DHE_RSA_WITH_AES_256_CBC_SHA"; 
-      break; 
-    case TLS_DH_anon_WITH_AES_256_CBC_SHA: 
-      return "TLS_DH_anon_WITH_AES_256_CBC_SHA"; 
-      break; 
-    /* SSL version 2.0 */ 
-    case SSL_RSA_WITH_RC2_CBC_MD5: 
-      return "SSL_RSA_WITH_RC2_CBC_MD5"; 
-      break; 
-    case SSL_RSA_WITH_IDEA_CBC_MD5: 
-      return "SSL_RSA_WITH_IDEA_CBC_MD5"; 
-      break; 
-    case SSL_RSA_WITH_DES_CBC_MD5: 
-      return "SSL_RSA_WITH_DES_CBC_MD5"; 
-      break; 
-    case SSL_RSA_WITH_3DES_EDE_CBC_MD5: 
-      return "SSL_RSA_WITH_3DES_EDE_CBC_MD5"; 
-      break; 
-  } 
-  return "SSL_NULL_WITH_NULL_NULL"; 
-} 
- 
-CF_INLINE const char *TLSCipherNameForNumber(SSLCipherSuite cipher) 
-{ 
-  switch(cipher) { 
-    /* TLS 1.0 with AES (RFC 3268) */ 
-    case TLS_RSA_WITH_AES_128_CBC_SHA: 
-      return "TLS_RSA_WITH_AES_128_CBC_SHA"; 
-      break; 
-    case TLS_DH_DSS_WITH_AES_128_CBC_SHA: 
-      return "TLS_DH_DSS_WITH_AES_128_CBC_SHA"; 
-      break; 
-    case TLS_DH_RSA_WITH_AES_128_CBC_SHA: 
-      return "TLS_DH_RSA_WITH_AES_128_CBC_SHA"; 
-      break; 
-    case TLS_DHE_DSS_WITH_AES_128_CBC_SHA: 
-      return "TLS_DHE_DSS_WITH_AES_128_CBC_SHA"; 
-      break; 
-    case TLS_DHE_RSA_WITH_AES_128_CBC_SHA: 
-      return "TLS_DHE_RSA_WITH_AES_128_CBC_SHA"; 
-      break; 
-    case TLS_DH_anon_WITH_AES_128_CBC_SHA: 
-      return "TLS_DH_anon_WITH_AES_128_CBC_SHA"; 
-      break; 
-    case TLS_RSA_WITH_AES_256_CBC_SHA: 
-      return "TLS_RSA_WITH_AES_256_CBC_SHA"; 
-      break; 
-    case TLS_DH_DSS_WITH_AES_256_CBC_SHA: 
-      return "TLS_DH_DSS_WITH_AES_256_CBC_SHA"; 
-      break; 
-    case TLS_DH_RSA_WITH_AES_256_CBC_SHA: 
-      return "TLS_DH_RSA_WITH_AES_256_CBC_SHA"; 
-      break; 
-    case TLS_DHE_DSS_WITH_AES_256_CBC_SHA: 
-      return "TLS_DHE_DSS_WITH_AES_256_CBC_SHA"; 
-      break; 
-    case TLS_DHE_RSA_WITH_AES_256_CBC_SHA: 
-      return "TLS_DHE_RSA_WITH_AES_256_CBC_SHA"; 
-      break; 
-    case TLS_DH_anon_WITH_AES_256_CBC_SHA: 
-      return "TLS_DH_anon_WITH_AES_256_CBC_SHA"; 
-      break; 
-#if CURL_BUILD_MAC_10_6 || CURL_BUILD_IOS 
-    /* TLS 1.0 with ECDSA (RFC 4492) */ 
-    case TLS_ECDH_ECDSA_WITH_NULL_SHA: 
-      return "TLS_ECDH_ECDSA_WITH_NULL_SHA"; 
-      break; 
-    case TLS_ECDH_ECDSA_WITH_RC4_128_SHA: 
-      return "TLS_ECDH_ECDSA_WITH_RC4_128_SHA"; 
-      break; 
-    case TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA: 
-      return "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA"; 
-      break; 
-    case TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA: 
-      return "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA"; 
-      break; 
-    case TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA: 
-      return "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA"; 
-      break; 
-    case TLS_ECDHE_ECDSA_WITH_NULL_SHA: 
-      return "TLS_ECDHE_ECDSA_WITH_NULL_SHA"; 
-      break; 
-    case TLS_ECDHE_ECDSA_WITH_RC4_128_SHA: 
-      return "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA"; 
-      break; 
-    case TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA: 
-      return "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA"; 
-      break; 
-    case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA: 
-      return "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA"; 
-      break; 
-    case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA: 
-      return "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"; 
-      break; 
-    case TLS_ECDH_RSA_WITH_NULL_SHA: 
-      return "TLS_ECDH_RSA_WITH_NULL_SHA"; 
-      break; 
-    case TLS_ECDH_RSA_WITH_RC4_128_SHA: 
-      return "TLS_ECDH_RSA_WITH_RC4_128_SHA"; 
-      break; 
-    case TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA: 
-      return "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA"; 
-      break; 
-    case TLS_ECDH_RSA_WITH_AES_128_CBC_SHA: 
-      return "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA"; 
-      break; 
-    case TLS_ECDH_RSA_WITH_AES_256_CBC_SHA: 
-      return "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA"; 
-      break; 
-    case TLS_ECDHE_RSA_WITH_NULL_SHA: 
-      return "TLS_ECDHE_RSA_WITH_NULL_SHA"; 
-      break; 
-    case TLS_ECDHE_RSA_WITH_RC4_128_SHA: 
-      return "TLS_ECDHE_RSA_WITH_RC4_128_SHA"; 
-      break; 
-    case TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA: 
-      return "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA"; 
-      break; 
-    case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA: 
-      return "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"; 
-      break; 
-    case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA: 
-      return "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"; 
-      break; 
-    case TLS_ECDH_anon_WITH_NULL_SHA: 
-      return "TLS_ECDH_anon_WITH_NULL_SHA"; 
-      break; 
-    case TLS_ECDH_anon_WITH_RC4_128_SHA: 
-      return "TLS_ECDH_anon_WITH_RC4_128_SHA"; 
-      break; 
-    case TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA: 
-      return "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA"; 
-      break; 
-    case TLS_ECDH_anon_WITH_AES_128_CBC_SHA: 
-      return "TLS_ECDH_anon_WITH_AES_128_CBC_SHA"; 
-      break; 
-    case TLS_ECDH_anon_WITH_AES_256_CBC_SHA: 
-      return "TLS_ECDH_anon_WITH_AES_256_CBC_SHA"; 
-      break; 
-#endif /* CURL_BUILD_MAC_10_6 || CURL_BUILD_IOS */ 
-#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS 
-    /* TLS 1.2 (RFC 5246) */ 
-    case TLS_RSA_WITH_NULL_MD5: 
-      return "TLS_RSA_WITH_NULL_MD5"; 
-      break; 
-    case TLS_RSA_WITH_NULL_SHA: 
-      return "TLS_RSA_WITH_NULL_SHA"; 
-      break; 
-    case TLS_RSA_WITH_RC4_128_MD5: 
-      return "TLS_RSA_WITH_RC4_128_MD5"; 
-      break; 
-    case TLS_RSA_WITH_RC4_128_SHA: 
-      return "TLS_RSA_WITH_RC4_128_SHA"; 
-      break; 
-    case TLS_RSA_WITH_3DES_EDE_CBC_SHA: 
-      return "TLS_RSA_WITH_3DES_EDE_CBC_SHA"; 
-      break; 
-    case TLS_RSA_WITH_NULL_SHA256: 
-      return "TLS_RSA_WITH_NULL_SHA256"; 
-      break; 
-    case TLS_RSA_WITH_AES_128_CBC_SHA256: 
-      return "TLS_RSA_WITH_AES_128_CBC_SHA256"; 
-      break; 
-    case TLS_RSA_WITH_AES_256_CBC_SHA256: 
-      return "TLS_RSA_WITH_AES_256_CBC_SHA256"; 
-      break; 
-    case TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA: 
-      return "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA"; 
-      break; 
-    case TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA: 
-      return "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA"; 
-      break; 
-    case TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA: 
-      return "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA"; 
-      break; 
-    case TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA: 
-      return "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA"; 
-      break; 
-    case TLS_DH_DSS_WITH_AES_128_CBC_SHA256: 
-      return "TLS_DH_DSS_WITH_AES_128_CBC_SHA256"; 
-      break; 
-    case TLS_DH_RSA_WITH_AES_128_CBC_SHA256: 
-      return "TLS_DH_RSA_WITH_AES_128_CBC_SHA256"; 
-      break; 
-    case TLS_DHE_DSS_WITH_AES_128_CBC_SHA256: 
-      return "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256"; 
-      break; 
-    case TLS_DHE_RSA_WITH_AES_128_CBC_SHA256: 
-      return "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256"; 
-      break; 
-    case TLS_DH_DSS_WITH_AES_256_CBC_SHA256: 
-      return "TLS_DH_DSS_WITH_AES_256_CBC_SHA256"; 
-      break; 
-    case TLS_DH_RSA_WITH_AES_256_CBC_SHA256: 
-      return "TLS_DH_RSA_WITH_AES_256_CBC_SHA256"; 
-      break; 
-    case TLS_DHE_DSS_WITH_AES_256_CBC_SHA256: 
-      return "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256"; 
-      break; 
-    case TLS_DHE_RSA_WITH_AES_256_CBC_SHA256: 
-      return "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256"; 
-      break; 
-    case TLS_DH_anon_WITH_RC4_128_MD5: 
-      return "TLS_DH_anon_WITH_RC4_128_MD5"; 
-      break; 
-    case TLS_DH_anon_WITH_3DES_EDE_CBC_SHA: 
-      return "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA"; 
-      break; 
-    case TLS_DH_anon_WITH_AES_128_CBC_SHA256: 
-      return "TLS_DH_anon_WITH_AES_128_CBC_SHA256"; 
-      break; 
-    case TLS_DH_anon_WITH_AES_256_CBC_SHA256: 
-      return "TLS_DH_anon_WITH_AES_256_CBC_SHA256"; 
-      break; 
-    /* TLS 1.2 with AES GCM (RFC 5288) */ 
-    case TLS_RSA_WITH_AES_128_GCM_SHA256: 
-      return "TLS_RSA_WITH_AES_128_GCM_SHA256"; 
-      break; 
-    case TLS_RSA_WITH_AES_256_GCM_SHA384: 
-      return "TLS_RSA_WITH_AES_256_GCM_SHA384"; 
-      break; 
-    case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256: 
-      return "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256"; 
-      break; 
-    case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384: 
-      return "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384"; 
-      break; 
-    case TLS_DH_RSA_WITH_AES_128_GCM_SHA256: 
-      return "TLS_DH_RSA_WITH_AES_128_GCM_SHA256"; 
-      break; 
-    case TLS_DH_RSA_WITH_AES_256_GCM_SHA384: 
-      return "TLS_DH_RSA_WITH_AES_256_GCM_SHA384"; 
-      break; 
-    case TLS_DHE_DSS_WITH_AES_128_GCM_SHA256: 
-      return "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256"; 
-      break; 
-    case TLS_DHE_DSS_WITH_AES_256_GCM_SHA384: 
-      return "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384"; 
-      break; 
-    case TLS_DH_DSS_WITH_AES_128_GCM_SHA256: 
-      return "TLS_DH_DSS_WITH_AES_128_GCM_SHA256"; 
-      break; 
-    case TLS_DH_DSS_WITH_AES_256_GCM_SHA384: 
-      return "TLS_DH_DSS_WITH_AES_256_GCM_SHA384"; 
-      break; 
-    case TLS_DH_anon_WITH_AES_128_GCM_SHA256: 
-      return "TLS_DH_anon_WITH_AES_128_GCM_SHA256"; 
-      break; 
-    case TLS_DH_anon_WITH_AES_256_GCM_SHA384: 
-      return "TLS_DH_anon_WITH_AES_256_GCM_SHA384"; 
-      break; 
-    /* TLS 1.2 with elliptic curve ciphers (RFC 5289) */ 
-    case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256: 
-      return "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"; 
-      break; 
-    case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384: 
-      return "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384"; 
-      break; 
-    case TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256: 
-      return "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256"; 
-      break; 
-    case TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384: 
-      return "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384"; 
-      break; 
-    case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256: 
-      return "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"; 
-      break; 
-    case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384: 
-      return "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"; 
-      break; 
-    case TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256: 
-      return "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256"; 
-      break; 
-    case TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384: 
-      return "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384"; 
-      break; 
-    case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: 
-      return "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"; 
-      break; 
-    case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: 
-      return "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"; 
-      break; 
-    case TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256: 
-      return "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256"; 
-      break; 
-    case TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384: 
-      return "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384"; 
-      break; 
-    case TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: 
-      return "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"; 
-      break; 
-    case TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: 
-      return "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"; 
-      break; 
-    case TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256: 
-      return "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256"; 
-      break; 
-    case TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384: 
-      return "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384"; 
-      break; 
-    case TLS_EMPTY_RENEGOTIATION_INFO_SCSV: 
-      return "TLS_EMPTY_RENEGOTIATION_INFO_SCSV"; 
-      break; 
-#else 
-    case SSL_RSA_WITH_NULL_MD5: 
-      return "TLS_RSA_WITH_NULL_MD5"; 
-      break; 
-    case SSL_RSA_WITH_NULL_SHA: 
-      return "TLS_RSA_WITH_NULL_SHA"; 
-      break; 
-    case SSL_RSA_WITH_RC4_128_MD5: 
-      return "TLS_RSA_WITH_RC4_128_MD5"; 
-      break; 
-    case SSL_RSA_WITH_RC4_128_SHA: 
-      return "TLS_RSA_WITH_RC4_128_SHA"; 
-      break; 
-    case SSL_RSA_WITH_3DES_EDE_CBC_SHA: 
-      return "TLS_RSA_WITH_3DES_EDE_CBC_SHA"; 
-      break; 
-    case SSL_DH_anon_WITH_RC4_128_MD5: 
-      return "TLS_DH_anon_WITH_RC4_128_MD5"; 
-      break; 
-    case SSL_DH_anon_WITH_3DES_EDE_CBC_SHA: 
-      return "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA"; 
-      break; 
-#endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */ 
-#if CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7 
-    /* TLS PSK (RFC 4279): */ 
-    case TLS_PSK_WITH_RC4_128_SHA: 
-      return "TLS_PSK_WITH_RC4_128_SHA"; 
-      break; 
-    case TLS_PSK_WITH_3DES_EDE_CBC_SHA: 
-      return "TLS_PSK_WITH_3DES_EDE_CBC_SHA"; 
-      break; 
-    case TLS_PSK_WITH_AES_128_CBC_SHA: 
-      return "TLS_PSK_WITH_AES_128_CBC_SHA"; 
-      break; 
-    case TLS_PSK_WITH_AES_256_CBC_SHA: 
-      return "TLS_PSK_WITH_AES_256_CBC_SHA"; 
-      break; 
-    case TLS_DHE_PSK_WITH_RC4_128_SHA: 
-      return "TLS_DHE_PSK_WITH_RC4_128_SHA"; 
-      break; 
-    case TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA: 
-      return "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA"; 
-      break; 
-    case TLS_DHE_PSK_WITH_AES_128_CBC_SHA: 
-      return "TLS_DHE_PSK_WITH_AES_128_CBC_SHA"; 
-      break; 
-    case TLS_DHE_PSK_WITH_AES_256_CBC_SHA: 
-      return "TLS_DHE_PSK_WITH_AES_256_CBC_SHA"; 
-      break; 
-    case TLS_RSA_PSK_WITH_RC4_128_SHA: 
-      return "TLS_RSA_PSK_WITH_RC4_128_SHA"; 
-      break; 
-    case TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA: 
-      return "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA"; 
-      break; 
-    case TLS_RSA_PSK_WITH_AES_128_CBC_SHA: 
-      return "TLS_RSA_PSK_WITH_AES_128_CBC_SHA"; 
-      break; 
-    case TLS_RSA_PSK_WITH_AES_256_CBC_SHA: 
-      return "TLS_RSA_PSK_WITH_AES_256_CBC_SHA"; 
-      break; 
-    /* More TLS PSK (RFC 4785): */ 
-    case TLS_PSK_WITH_NULL_SHA: 
-      return "TLS_PSK_WITH_NULL_SHA"; 
-      break; 
-    case TLS_DHE_PSK_WITH_NULL_SHA: 
-      return "TLS_DHE_PSK_WITH_NULL_SHA"; 
-      break; 
-    case TLS_RSA_PSK_WITH_NULL_SHA: 
-      return "TLS_RSA_PSK_WITH_NULL_SHA"; 
-      break; 
-    /* Even more TLS PSK (RFC 5487): */ 
-    case TLS_PSK_WITH_AES_128_GCM_SHA256: 
-      return "TLS_PSK_WITH_AES_128_GCM_SHA256"; 
-      break; 
-    case TLS_PSK_WITH_AES_256_GCM_SHA384: 
-      return "TLS_PSK_WITH_AES_256_GCM_SHA384"; 
-      break; 
-    case TLS_DHE_PSK_WITH_AES_128_GCM_SHA256: 
-      return "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256"; 
-      break; 
-    case TLS_DHE_PSK_WITH_AES_256_GCM_SHA384: 
-      return "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384"; 
-      break; 
-    case TLS_RSA_PSK_WITH_AES_128_GCM_SHA256: 
-      return "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256"; 
-      break; 
-    case TLS_RSA_PSK_WITH_AES_256_GCM_SHA384: 
-      return "TLS_PSK_WITH_AES_256_GCM_SHA384"; 
-      break; 
-    case TLS_PSK_WITH_AES_128_CBC_SHA256: 
-      return "TLS_PSK_WITH_AES_128_CBC_SHA256"; 
-      break; 
-    case TLS_PSK_WITH_AES_256_CBC_SHA384: 
-      return "TLS_PSK_WITH_AES_256_CBC_SHA384"; 
-      break; 
-    case TLS_PSK_WITH_NULL_SHA256: 
-      return "TLS_PSK_WITH_NULL_SHA256"; 
-      break; 
-    case TLS_PSK_WITH_NULL_SHA384: 
-      return "TLS_PSK_WITH_NULL_SHA384"; 
-      break; 
-    case TLS_DHE_PSK_WITH_AES_128_CBC_SHA256: 
-      return "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256"; 
-      break; 
-    case TLS_DHE_PSK_WITH_AES_256_CBC_SHA384: 
-      return "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384"; 
-      break; 
-    case TLS_DHE_PSK_WITH_NULL_SHA256: 
-      return "TLS_DHE_PSK_WITH_NULL_SHA256"; 
-      break; 
-    case TLS_DHE_PSK_WITH_NULL_SHA384: 
-      return "TLS_RSA_PSK_WITH_NULL_SHA384"; 
-      break; 
-    case TLS_RSA_PSK_WITH_AES_128_CBC_SHA256: 
-      return "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256"; 
-      break; 
-    case TLS_RSA_PSK_WITH_AES_256_CBC_SHA384: 
-      return "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384"; 
-      break; 
-    case TLS_RSA_PSK_WITH_NULL_SHA256: 
-      return "TLS_RSA_PSK_WITH_NULL_SHA256"; 
-      break; 
-    case TLS_RSA_PSK_WITH_NULL_SHA384: 
-      return "TLS_RSA_PSK_WITH_NULL_SHA384"; 
-      break; 
-#endif /* CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7 */ 
-#if CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11 
-    /* New ChaCha20+Poly1305 cipher-suites used by TLS 1.3: */ 
-    case TLS_AES_128_GCM_SHA256: 
-      return "TLS_AES_128_GCM_SHA256"; 
-      break; 
-    case TLS_AES_256_GCM_SHA384: 
-      return "TLS_AES_256_GCM_SHA384"; 
-      break; 
-    case TLS_CHACHA20_POLY1305_SHA256: 
-      return "TLS_CHACHA20_POLY1305_SHA256"; 
-      break; 
-    case TLS_AES_128_CCM_SHA256: 
-      return "TLS_AES_128_CCM_SHA256"; 
-      break; 
-    case TLS_AES_128_CCM_8_SHA256: 
-      return "TLS_AES_128_CCM_8_SHA256"; 
-      break; 
-    case TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256: 
-      return "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"; 
-      break; 
-    case TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256: 
-      return "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"; 
-      break; 
-#endif /* CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11 */ 
-  } 
-  return "TLS_NULL_WITH_NULL_NULL"; 
-} 
-#endif /* !CURL_DISABLE_VERBOSE_STRINGS */ 
- 
-#if CURL_BUILD_MAC 
-CF_INLINE void GetDarwinVersionNumber(int *major, int *minor) 
-{ 
-  int mib[2]; 
-  char *os_version; 
-  size_t os_version_len; 
-  char *os_version_major, *os_version_minor; 
-  char *tok_buf; 
- 
-  /* Get the Darwin kernel version from the kernel using sysctl(): */ 
-  mib[0] = CTL_KERN; 
-  mib[1] = KERN_OSRELEASE; 
-  if(sysctl(mib, 2, NULL, &os_version_len, NULL, 0) == -1) 
-    return; 
-  os_version = malloc(os_version_len*sizeof(char)); 
-  if(!os_version) 
-    return; 
-  if(sysctl(mib, 2, os_version, &os_version_len, NULL, 0) == -1) { 
-    free(os_version); 
-    return; 
-  } 
- 
-  /* Parse the version: */ 
-  os_version_major = strtok_r(os_version, ".", &tok_buf); 
-  os_version_minor = strtok_r(NULL, ".", &tok_buf); 
-  *major = atoi(os_version_major); 
-  *minor = atoi(os_version_minor); 
-  free(os_version); 
-} 
-#endif /* CURL_BUILD_MAC */ 
- 
-/* Apple provides a myriad of ways of getting information about a certificate 
-   into a string. Some aren't available under iOS or newer cats. So here's 
-   a unified function for getting a string describing the certificate that 
-   ought to work in all cats starting with Leopard. */ 
-CF_INLINE CFStringRef getsubject(SecCertificateRef cert) 
-{ 
-  CFStringRef server_cert_summary = CFSTR("(null)"); 
- 
-#if CURL_BUILD_IOS 
-  /* iOS: There's only one way to do this. */ 
-  server_cert_summary = SecCertificateCopySubjectSummary(cert); 
-#else 
-#if CURL_BUILD_MAC_10_7 
-  /* Lion & later: Get the long description if we can. */ 
-  if(SecCertificateCopyLongDescription != NULL) 
-    server_cert_summary = 
-      SecCertificateCopyLongDescription(NULL, cert, NULL); 
-  else 
-#endif /* CURL_BUILD_MAC_10_7 */ 
-#if CURL_BUILD_MAC_10_6 
-  /* Snow Leopard: Get the certificate summary. */ 
-  if(SecCertificateCopySubjectSummary != NULL) 
-    server_cert_summary = SecCertificateCopySubjectSummary(cert); 
-  else 
-#endif /* CURL_BUILD_MAC_10_6 */ 
-  /* Leopard is as far back as we go... */ 
-  (void)SecCertificateCopyCommonName(cert, &server_cert_summary); 
-#endif /* CURL_BUILD_IOS */ 
-  return server_cert_summary; 
-} 
- 
-static CURLcode CopyCertSubject(struct Curl_easy *data, 
-                                SecCertificateRef cert, char **certp) 
-{ 
-  CFStringRef c = getsubject(cert); 
-  CURLcode result = CURLE_OK; 
-  const char *direct; 
-  char *cbuf = NULL; 
-  *certp = NULL; 
- 
-  if(!c) { 
-    failf(data, "SSL: invalid CA certificate subject"); 
-    return CURLE_PEER_FAILED_VERIFICATION; 
-  } 
- 
-  /* If the subject is already available as UTF-8 encoded (ie 'direct') then 
-     use that, else convert it. */ 
-  direct = CFStringGetCStringPtr(c, kCFStringEncodingUTF8); 
-  if(direct) { 
-    *certp = strdup(direct); 
-    if(!*certp) { 
-      failf(data, "SSL: out of memory"); 
-      result = CURLE_OUT_OF_MEMORY; 
-    } 
-  } 
-  else { 
-    size_t cbuf_size = ((size_t)CFStringGetLength(c) * 4) + 1; 
-    cbuf = calloc(cbuf_size, 1); 
-    if(cbuf) { 
-      if(!CFStringGetCString(c, cbuf, cbuf_size, 
-                             kCFStringEncodingUTF8)) { 
-        failf(data, "SSL: invalid CA certificate subject"); 
-        result = CURLE_PEER_FAILED_VERIFICATION; 
-      } 
-      else 
-        /* pass back the buffer */ 
-        *certp = cbuf; 
-    } 
-    else { 
-      failf(data, "SSL: couldn't allocate %zu bytes of memory", cbuf_size); 
-      result = CURLE_OUT_OF_MEMORY; 
-    } 
-  } 
-  if(result) 
-    free(cbuf); 
-  CFRelease(c); 
-  return result; 
-} 
- 
-#if CURL_SUPPORT_MAC_10_6 
-/* The SecKeychainSearch API was deprecated in Lion, and using it will raise 
-   deprecation warnings, so let's not compile this unless it's necessary: */ 
-static OSStatus CopyIdentityWithLabelOldSchool(char *label, 
-                                               SecIdentityRef *out_c_a_k) 
-{ 
-  OSStatus status = errSecItemNotFound; 
-  SecKeychainAttributeList attr_list; 
-  SecKeychainAttribute attr; 
-  SecKeychainSearchRef search = NULL; 
-  SecCertificateRef cert = NULL; 
- 
-  /* Set up the attribute list: */ 
-  attr_list.count = 1L; 
-  attr_list.attr = &attr; 
- 
-  /* Set up our lone search criterion: */ 
-  attr.tag = kSecLabelItemAttr; 
-  attr.data = label; 
-  attr.length = (UInt32)strlen(label); 
- 
-  /* Start searching: */ 
-  status = SecKeychainSearchCreateFromAttributes(NULL, 
-                                                 kSecCertificateItemClass, 
-                                                 &attr_list, 
-                                                 &search); 
-  if(status == noErr) { 
-    status = SecKeychainSearchCopyNext(search, 
-                                       (SecKeychainItemRef *)&cert); 
-    if(status == noErr && cert) { 
-      /* If we found a certificate, does it have a private key? */ 
-      status = SecIdentityCreateWithCertificate(NULL, cert, out_c_a_k); 
-      CFRelease(cert); 
-    } 
-  } 
- 
-  if(search) 
-    CFRelease(search); 
-  return status; 
-} 
-#endif /* CURL_SUPPORT_MAC_10_6 */ 
- 
-static OSStatus CopyIdentityWithLabel(char *label, 
-                                      SecIdentityRef *out_cert_and_key) 
-{ 
-  OSStatus status = errSecItemNotFound; 
- 
-#if CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS 
-  CFArrayRef keys_list; 
-  CFIndex keys_list_count; 
-  CFIndex i; 
-  CFStringRef common_name; 
- 
-  /* SecItemCopyMatching() was introduced in iOS and Snow Leopard. 
-     kSecClassIdentity was introduced in Lion. If both exist, let's use them 
-     to find the certificate. */ 
-  if(SecItemCopyMatching != NULL && kSecClassIdentity != NULL) { 
-    CFTypeRef keys[5]; 
-    CFTypeRef values[5]; 
-    CFDictionaryRef query_dict; 
-    CFStringRef label_cf = CFStringCreateWithCString(NULL, label, 
-      kCFStringEncodingUTF8); 
- 
-    /* Set up our search criteria and expected results: */ 
-    values[0] = kSecClassIdentity; /* we want a certificate and a key */ 
-    keys[0] = kSecClass; 
-    values[1] = kCFBooleanTrue;    /* we want a reference */ 
-    keys[1] = kSecReturnRef; 
-    values[2] = kSecMatchLimitAll; /* kSecMatchLimitOne would be better if the 
-                                    * label matching below worked correctly */ 
-    keys[2] = kSecMatchLimit; 
-    /* identity searches need a SecPolicyRef in order to work */ 
-    values[3] = SecPolicyCreateSSL(false, NULL); 
-    keys[3] = kSecMatchPolicy; 
-    /* match the name of the certificate (doesn't work in macOS 10.12.1) */ 
-    values[4] = label_cf; 
-    keys[4] = kSecAttrLabel; 
-    query_dict = CFDictionaryCreate(NULL, (const void **)keys, 
-                                    (const void **)values, 5L, 
-                                    &kCFCopyStringDictionaryKeyCallBacks, 
-                                    &kCFTypeDictionaryValueCallBacks); 
-    CFRelease(values[3]); 
- 
-    /* Do we have a match? */ 
-    status = SecItemCopyMatching(query_dict, (CFTypeRef *) &keys_list); 
- 
-    /* Because kSecAttrLabel matching doesn't work with kSecClassIdentity, 
-     * we need to find the correct identity ourselves */ 
-    if(status == noErr) { 
-      keys_list_count = CFArrayGetCount(keys_list); 
-      *out_cert_and_key = NULL; 
-      status = 1; 
-      for(i = 0; i<keys_list_count; i++) { 
-        OSStatus err = noErr; 
-        SecCertificateRef cert = NULL; 
-        SecIdentityRef identity = 
-          (SecIdentityRef) CFArrayGetValueAtIndex(keys_list, i); 
-        err = SecIdentityCopyCertificate(identity, &cert); 
-        if(err == noErr) { 
-#if CURL_BUILD_IOS 
-          common_name = SecCertificateCopySubjectSummary(cert); 
-#elif CURL_BUILD_MAC_10_7 
-          SecCertificateCopyCommonName(cert, &common_name); 
-#endif 
-          if(CFStringCompare(common_name, label_cf, 0) == kCFCompareEqualTo) { 
-            CFRelease(cert); 
-            CFRelease(common_name); 
-            CFRetain(identity); 
-            *out_cert_and_key = identity; 
-            status = noErr; 
-            break; 
-          } 
-          CFRelease(common_name); 
-        } 
-        CFRelease(cert); 
-      } 
-    } 
- 
-    if(keys_list) 
-      CFRelease(keys_list); 
-    CFRelease(query_dict); 
-    CFRelease(label_cf); 
-  } 
-  else { 
-#if CURL_SUPPORT_MAC_10_6 
-    /* On Leopard and Snow Leopard, fall back to SecKeychainSearch. */ 
-    status = CopyIdentityWithLabelOldSchool(label, out_cert_and_key); 
-#endif /* CURL_SUPPORT_MAC_10_6 */ 
-  } 
-#elif CURL_SUPPORT_MAC_10_6 
-  /* For developers building on older cats, we have no choice but to fall back 
-     to SecKeychainSearch. */ 
-  status = CopyIdentityWithLabelOldSchool(label, out_cert_and_key); 
-#endif /* CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS */ 
-  return status; 
-} 
- 
-static OSStatus CopyIdentityFromPKCS12File(const char *cPath, 
+    }
+    else {
+      ortn = ioErr;
+    }
+  }
+  else {
+    ortn = noErr;
+  }
+  *dataLength = bytesSent;
+  return ortn;
+}
+
+#ifndef CURL_DISABLE_VERBOSE_STRINGS
+CF_INLINE const char *SSLCipherNameForNumber(SSLCipherSuite cipher)
+{
+  switch(cipher) {
+    /* SSL version 3.0 */
+    case SSL_RSA_WITH_NULL_MD5:
+      return "SSL_RSA_WITH_NULL_MD5";
+      break;
+    case SSL_RSA_WITH_NULL_SHA:
+      return "SSL_RSA_WITH_NULL_SHA";
+      break;
+    case SSL_RSA_EXPORT_WITH_RC4_40_MD5:
+      return "SSL_RSA_EXPORT_WITH_RC4_40_MD5";
+      break;
+    case SSL_RSA_WITH_RC4_128_MD5:
+      return "SSL_RSA_WITH_RC4_128_MD5";
+      break;
+    case SSL_RSA_WITH_RC4_128_SHA:
+      return "SSL_RSA_WITH_RC4_128_SHA";
+      break;
+    case SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5:
+      return "SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5";
+      break;
+    case SSL_RSA_WITH_IDEA_CBC_SHA:
+      return "SSL_RSA_WITH_IDEA_CBC_SHA";
+      break;
+    case SSL_RSA_EXPORT_WITH_DES40_CBC_SHA:
+      return "SSL_RSA_EXPORT_WITH_DES40_CBC_SHA";
+      break;
+    case SSL_RSA_WITH_DES_CBC_SHA:
+      return "SSL_RSA_WITH_DES_CBC_SHA";
+      break;
+    case SSL_RSA_WITH_3DES_EDE_CBC_SHA:
+      return "SSL_RSA_WITH_3DES_EDE_CBC_SHA";
+      break;
+    case SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA:
+      return "SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA";
+      break;
+    case SSL_DH_DSS_WITH_DES_CBC_SHA:
+      return "SSL_DH_DSS_WITH_DES_CBC_SHA";
+      break;
+    case SSL_DH_DSS_WITH_3DES_EDE_CBC_SHA:
+      return "SSL_DH_DSS_WITH_3DES_EDE_CBC_SHA";
+      break;
+    case SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA:
+      return "SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA";
+      break;
+    case SSL_DH_RSA_WITH_DES_CBC_SHA:
+      return "SSL_DH_RSA_WITH_DES_CBC_SHA";
+      break;
+    case SSL_DH_RSA_WITH_3DES_EDE_CBC_SHA:
+      return "SSL_DH_RSA_WITH_3DES_EDE_CBC_SHA";
+      break;
+    case SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA:
+      return "SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA";
+      break;
+    case SSL_DHE_DSS_WITH_DES_CBC_SHA:
+      return "SSL_DHE_DSS_WITH_DES_CBC_SHA";
+      break;
+    case SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA:
+      return "SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA";
+      break;
+    case SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA:
+      return "SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA";
+      break;
+    case SSL_DHE_RSA_WITH_DES_CBC_SHA:
+      return "SSL_DHE_RSA_WITH_DES_CBC_SHA";
+      break;
+    case SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA:
+      return "SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA";
+      break;
+    case SSL_DH_anon_EXPORT_WITH_RC4_40_MD5:
+      return "SSL_DH_anon_EXPORT_WITH_RC4_40_MD5";
+      break;
+    case SSL_DH_anon_WITH_RC4_128_MD5:
+      return "SSL_DH_anon_WITH_RC4_128_MD5";
+      break;
+    case SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA:
+      return "SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA";
+      break;
+    case SSL_DH_anon_WITH_DES_CBC_SHA:
+      return "SSL_DH_anon_WITH_DES_CBC_SHA";
+      break;
+    case SSL_DH_anon_WITH_3DES_EDE_CBC_SHA:
+      return "SSL_DH_anon_WITH_3DES_EDE_CBC_SHA";
+      break;
+    case SSL_FORTEZZA_DMS_WITH_NULL_SHA:
+      return "SSL_FORTEZZA_DMS_WITH_NULL_SHA";
+      break;
+    case SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA:
+      return "SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA";
+      break;
+    /* TLS 1.0 with AES (RFC 3268)
+       (Apparently these are used in SSLv3 implementations as well.) */
+    case TLS_RSA_WITH_AES_128_CBC_SHA:
+      return "TLS_RSA_WITH_AES_128_CBC_SHA";
+      break;
+    case TLS_DH_DSS_WITH_AES_128_CBC_SHA:
+      return "TLS_DH_DSS_WITH_AES_128_CBC_SHA";
+      break;
+    case TLS_DH_RSA_WITH_AES_128_CBC_SHA:
+      return "TLS_DH_RSA_WITH_AES_128_CBC_SHA";
+      break;
+    case TLS_DHE_DSS_WITH_AES_128_CBC_SHA:
+      return "TLS_DHE_DSS_WITH_AES_128_CBC_SHA";
+      break;
+    case TLS_DHE_RSA_WITH_AES_128_CBC_SHA:
+      return "TLS_DHE_RSA_WITH_AES_128_CBC_SHA";
+      break;
+    case TLS_DH_anon_WITH_AES_128_CBC_SHA:
+      return "TLS_DH_anon_WITH_AES_128_CBC_SHA";
+      break;
+    case TLS_RSA_WITH_AES_256_CBC_SHA:
+      return "TLS_RSA_WITH_AES_256_CBC_SHA";
+      break;
+    case TLS_DH_DSS_WITH_AES_256_CBC_SHA:
+      return "TLS_DH_DSS_WITH_AES_256_CBC_SHA";
+      break;
+    case TLS_DH_RSA_WITH_AES_256_CBC_SHA:
+      return "TLS_DH_RSA_WITH_AES_256_CBC_SHA";
+      break;
+    case TLS_DHE_DSS_WITH_AES_256_CBC_SHA:
+      return "TLS_DHE_DSS_WITH_AES_256_CBC_SHA";
+      break;
+    case TLS_DHE_RSA_WITH_AES_256_CBC_SHA:
+      return "TLS_DHE_RSA_WITH_AES_256_CBC_SHA";
+      break;
+    case TLS_DH_anon_WITH_AES_256_CBC_SHA:
+      return "TLS_DH_anon_WITH_AES_256_CBC_SHA";
+      break;
+    /* SSL version 2.0 */
+    case SSL_RSA_WITH_RC2_CBC_MD5:
+      return "SSL_RSA_WITH_RC2_CBC_MD5";
+      break;
+    case SSL_RSA_WITH_IDEA_CBC_MD5:
+      return "SSL_RSA_WITH_IDEA_CBC_MD5";
+      break;
+    case SSL_RSA_WITH_DES_CBC_MD5:
+      return "SSL_RSA_WITH_DES_CBC_MD5";
+      break;
+    case SSL_RSA_WITH_3DES_EDE_CBC_MD5:
+      return "SSL_RSA_WITH_3DES_EDE_CBC_MD5";
+      break;
+  }
+  return "SSL_NULL_WITH_NULL_NULL";
+}
+
+CF_INLINE const char *TLSCipherNameForNumber(SSLCipherSuite cipher)
+{
+  switch(cipher) {
+    /* TLS 1.0 with AES (RFC 3268) */
+    case TLS_RSA_WITH_AES_128_CBC_SHA:
+      return "TLS_RSA_WITH_AES_128_CBC_SHA";
+      break;
+    case TLS_DH_DSS_WITH_AES_128_CBC_SHA:
+      return "TLS_DH_DSS_WITH_AES_128_CBC_SHA";
+      break;
+    case TLS_DH_RSA_WITH_AES_128_CBC_SHA:
+      return "TLS_DH_RSA_WITH_AES_128_CBC_SHA";
+      break;
+    case TLS_DHE_DSS_WITH_AES_128_CBC_SHA:
+      return "TLS_DHE_DSS_WITH_AES_128_CBC_SHA";
+      break;
+    case TLS_DHE_RSA_WITH_AES_128_CBC_SHA:
+      return "TLS_DHE_RSA_WITH_AES_128_CBC_SHA";
+      break;
+    case TLS_DH_anon_WITH_AES_128_CBC_SHA:
+      return "TLS_DH_anon_WITH_AES_128_CBC_SHA";
+      break;
+    case TLS_RSA_WITH_AES_256_CBC_SHA:
+      return "TLS_RSA_WITH_AES_256_CBC_SHA";
+      break;
+    case TLS_DH_DSS_WITH_AES_256_CBC_SHA:
+      return "TLS_DH_DSS_WITH_AES_256_CBC_SHA";
+      break;
+    case TLS_DH_RSA_WITH_AES_256_CBC_SHA:
+      return "TLS_DH_RSA_WITH_AES_256_CBC_SHA";
+      break;
+    case TLS_DHE_DSS_WITH_AES_256_CBC_SHA:
+      return "TLS_DHE_DSS_WITH_AES_256_CBC_SHA";
+      break;
+    case TLS_DHE_RSA_WITH_AES_256_CBC_SHA:
+      return "TLS_DHE_RSA_WITH_AES_256_CBC_SHA";
+      break;
+    case TLS_DH_anon_WITH_AES_256_CBC_SHA:
+      return "TLS_DH_anon_WITH_AES_256_CBC_SHA";
+      break;
+#if CURL_BUILD_MAC_10_6 || CURL_BUILD_IOS
+    /* TLS 1.0 with ECDSA (RFC 4492) */
+    case TLS_ECDH_ECDSA_WITH_NULL_SHA:
+      return "TLS_ECDH_ECDSA_WITH_NULL_SHA";
+      break;
+    case TLS_ECDH_ECDSA_WITH_RC4_128_SHA:
+      return "TLS_ECDH_ECDSA_WITH_RC4_128_SHA";
+      break;
+    case TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA:
+      return "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA";
+      break;
+    case TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA:
+      return "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA";
+      break;
+    case TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA:
+      return "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA";
+      break;
+    case TLS_ECDHE_ECDSA_WITH_NULL_SHA:
+      return "TLS_ECDHE_ECDSA_WITH_NULL_SHA";
+      break;
+    case TLS_ECDHE_ECDSA_WITH_RC4_128_SHA:
+      return "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA";
+      break;
+    case TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA:
+      return "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA";
+      break;
+    case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:
+      return "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA";
+      break;
+    case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:
+      return "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA";
+      break;
+    case TLS_ECDH_RSA_WITH_NULL_SHA:
+      return "TLS_ECDH_RSA_WITH_NULL_SHA";
+      break;
+    case TLS_ECDH_RSA_WITH_RC4_128_SHA:
+      return "TLS_ECDH_RSA_WITH_RC4_128_SHA";
+      break;
+    case TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA:
+      return "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA";
+      break;
+    case TLS_ECDH_RSA_WITH_AES_128_CBC_SHA:
+      return "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA";
+      break;
+    case TLS_ECDH_RSA_WITH_AES_256_CBC_SHA:
+      return "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA";
+      break;
+    case TLS_ECDHE_RSA_WITH_NULL_SHA:
+      return "TLS_ECDHE_RSA_WITH_NULL_SHA";
+      break;
+    case TLS_ECDHE_RSA_WITH_RC4_128_SHA:
+      return "TLS_ECDHE_RSA_WITH_RC4_128_SHA";
+      break;
+    case TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA:
+      return "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA";
+      break;
+    case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:
+      return "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA";
+      break;
+    case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:
+      return "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA";
+      break;
+    case TLS_ECDH_anon_WITH_NULL_SHA:
+      return "TLS_ECDH_anon_WITH_NULL_SHA";
+      break;
+    case TLS_ECDH_anon_WITH_RC4_128_SHA:
+      return "TLS_ECDH_anon_WITH_RC4_128_SHA";
+      break;
+    case TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA:
+      return "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA";
+      break;
+    case TLS_ECDH_anon_WITH_AES_128_CBC_SHA:
+      return "TLS_ECDH_anon_WITH_AES_128_CBC_SHA";
+      break;
+    case TLS_ECDH_anon_WITH_AES_256_CBC_SHA:
+      return "TLS_ECDH_anon_WITH_AES_256_CBC_SHA";
+      break;
+#endif /* CURL_BUILD_MAC_10_6 || CURL_BUILD_IOS */
+#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
+    /* TLS 1.2 (RFC 5246) */
+    case TLS_RSA_WITH_NULL_MD5:
+      return "TLS_RSA_WITH_NULL_MD5";
+      break;
+    case TLS_RSA_WITH_NULL_SHA:
+      return "TLS_RSA_WITH_NULL_SHA";
+      break;
+    case TLS_RSA_WITH_RC4_128_MD5:
+      return "TLS_RSA_WITH_RC4_128_MD5";
+      break;
+    case TLS_RSA_WITH_RC4_128_SHA:
+      return "TLS_RSA_WITH_RC4_128_SHA";
+      break;
+    case TLS_RSA_WITH_3DES_EDE_CBC_SHA:
+      return "TLS_RSA_WITH_3DES_EDE_CBC_SHA";
+      break;
+    case TLS_RSA_WITH_NULL_SHA256:
+      return "TLS_RSA_WITH_NULL_SHA256";
+      break;
+    case TLS_RSA_WITH_AES_128_CBC_SHA256:
+      return "TLS_RSA_WITH_AES_128_CBC_SHA256";
+      break;
+    case TLS_RSA_WITH_AES_256_CBC_SHA256:
+      return "TLS_RSA_WITH_AES_256_CBC_SHA256";
+      break;
+    case TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA:
+      return "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA";
+      break;
+    case TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA:
+      return "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA";
+      break;
+    case TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA:
+      return "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA";
+      break;
+    case TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA:
+      return "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA";
+      break;
+    case TLS_DH_DSS_WITH_AES_128_CBC_SHA256:
+      return "TLS_DH_DSS_WITH_AES_128_CBC_SHA256";
+      break;
+    case TLS_DH_RSA_WITH_AES_128_CBC_SHA256:
+      return "TLS_DH_RSA_WITH_AES_128_CBC_SHA256";
+      break;
+    case TLS_DHE_DSS_WITH_AES_128_CBC_SHA256:
+      return "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256";
+      break;
+    case TLS_DHE_RSA_WITH_AES_128_CBC_SHA256:
+      return "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256";
+      break;
+    case TLS_DH_DSS_WITH_AES_256_CBC_SHA256:
+      return "TLS_DH_DSS_WITH_AES_256_CBC_SHA256";
+      break;
+    case TLS_DH_RSA_WITH_AES_256_CBC_SHA256:
+      return "TLS_DH_RSA_WITH_AES_256_CBC_SHA256";
+      break;
+    case TLS_DHE_DSS_WITH_AES_256_CBC_SHA256:
+      return "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256";
+      break;
+    case TLS_DHE_RSA_WITH_AES_256_CBC_SHA256:
+      return "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256";
+      break;
+    case TLS_DH_anon_WITH_RC4_128_MD5:
+      return "TLS_DH_anon_WITH_RC4_128_MD5";
+      break;
+    case TLS_DH_anon_WITH_3DES_EDE_CBC_SHA:
+      return "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA";
+      break;
+    case TLS_DH_anon_WITH_AES_128_CBC_SHA256:
+      return "TLS_DH_anon_WITH_AES_128_CBC_SHA256";
+      break;
+    case TLS_DH_anon_WITH_AES_256_CBC_SHA256:
+      return "TLS_DH_anon_WITH_AES_256_CBC_SHA256";
+      break;
+    /* TLS 1.2 with AES GCM (RFC 5288) */
+    case TLS_RSA_WITH_AES_128_GCM_SHA256:
+      return "TLS_RSA_WITH_AES_128_GCM_SHA256";
+      break;
+    case TLS_RSA_WITH_AES_256_GCM_SHA384:
+      return "TLS_RSA_WITH_AES_256_GCM_SHA384";
+      break;
+    case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256:
+      return "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256";
+      break;
+    case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384:
+      return "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384";
+      break;
+    case TLS_DH_RSA_WITH_AES_128_GCM_SHA256:
+      return "TLS_DH_RSA_WITH_AES_128_GCM_SHA256";
+      break;
+    case TLS_DH_RSA_WITH_AES_256_GCM_SHA384:
+      return "TLS_DH_RSA_WITH_AES_256_GCM_SHA384";
+      break;
+    case TLS_DHE_DSS_WITH_AES_128_GCM_SHA256:
+      return "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256";
+      break;
+    case TLS_DHE_DSS_WITH_AES_256_GCM_SHA384:
+      return "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384";
+      break;
+    case TLS_DH_DSS_WITH_AES_128_GCM_SHA256:
+      return "TLS_DH_DSS_WITH_AES_128_GCM_SHA256";
+      break;
+    case TLS_DH_DSS_WITH_AES_256_GCM_SHA384:
+      return "TLS_DH_DSS_WITH_AES_256_GCM_SHA384";
+      break;
+    case TLS_DH_anon_WITH_AES_128_GCM_SHA256:
+      return "TLS_DH_anon_WITH_AES_128_GCM_SHA256";
+      break;
+    case TLS_DH_anon_WITH_AES_256_GCM_SHA384:
+      return "TLS_DH_anon_WITH_AES_256_GCM_SHA384";
+      break;
+    /* TLS 1.2 with elliptic curve ciphers (RFC 5289) */
+    case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:
+      return "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256";
+      break;
+    case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384:
+      return "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384";
+      break;
+    case TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256:
+      return "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256";
+      break;
+    case TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384:
+      return "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384";
+      break;
+    case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256:
+      return "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256";
+      break;
+    case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384:
+      return "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384";
+      break;
+    case TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256:
+      return "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256";
+      break;
+    case TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384:
+      return "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384";
+      break;
+    case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
+      return "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256";
+      break;
+    case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:
+      return "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384";
+      break;
+    case TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256:
+      return "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256";
+      break;
+    case TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384:
+      return "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384";
+      break;
+    case TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:
+      return "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256";
+      break;
+    case TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:
+      return "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384";
+      break;
+    case TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256:
+      return "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256";
+      break;
+    case TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384:
+      return "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384";
+      break;
+    case TLS_EMPTY_RENEGOTIATION_INFO_SCSV:
+      return "TLS_EMPTY_RENEGOTIATION_INFO_SCSV";
+      break;
+#else
+    case SSL_RSA_WITH_NULL_MD5:
+      return "TLS_RSA_WITH_NULL_MD5";
+      break;
+    case SSL_RSA_WITH_NULL_SHA:
+      return "TLS_RSA_WITH_NULL_SHA";
+      break;
+    case SSL_RSA_WITH_RC4_128_MD5:
+      return "TLS_RSA_WITH_RC4_128_MD5";
+      break;
+    case SSL_RSA_WITH_RC4_128_SHA:
+      return "TLS_RSA_WITH_RC4_128_SHA";
+      break;
+    case SSL_RSA_WITH_3DES_EDE_CBC_SHA:
+      return "TLS_RSA_WITH_3DES_EDE_CBC_SHA";
+      break;
+    case SSL_DH_anon_WITH_RC4_128_MD5:
+      return "TLS_DH_anon_WITH_RC4_128_MD5";
+      break;
+    case SSL_DH_anon_WITH_3DES_EDE_CBC_SHA:
+      return "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA";
+      break;
+#endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */
+#if CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7
+    /* TLS PSK (RFC 4279): */
+    case TLS_PSK_WITH_RC4_128_SHA:
+      return "TLS_PSK_WITH_RC4_128_SHA";
+      break;
+    case TLS_PSK_WITH_3DES_EDE_CBC_SHA:
+      return "TLS_PSK_WITH_3DES_EDE_CBC_SHA";
+      break;
+    case TLS_PSK_WITH_AES_128_CBC_SHA:
+      return "TLS_PSK_WITH_AES_128_CBC_SHA";
+      break;
+    case TLS_PSK_WITH_AES_256_CBC_SHA:
+      return "TLS_PSK_WITH_AES_256_CBC_SHA";
+      break;
+    case TLS_DHE_PSK_WITH_RC4_128_SHA:
+      return "TLS_DHE_PSK_WITH_RC4_128_SHA";
+      break;
+    case TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA:
+      return "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA";
+      break;
+    case TLS_DHE_PSK_WITH_AES_128_CBC_SHA:
+      return "TLS_DHE_PSK_WITH_AES_128_CBC_SHA";
+      break;
+    case TLS_DHE_PSK_WITH_AES_256_CBC_SHA:
+      return "TLS_DHE_PSK_WITH_AES_256_CBC_SHA";
+      break;
+    case TLS_RSA_PSK_WITH_RC4_128_SHA:
+      return "TLS_RSA_PSK_WITH_RC4_128_SHA";
+      break;
+    case TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA:
+      return "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA";
+      break;
+    case TLS_RSA_PSK_WITH_AES_128_CBC_SHA:
+      return "TLS_RSA_PSK_WITH_AES_128_CBC_SHA";
+      break;
+    case TLS_RSA_PSK_WITH_AES_256_CBC_SHA:
+      return "TLS_RSA_PSK_WITH_AES_256_CBC_SHA";
+      break;
+    /* More TLS PSK (RFC 4785): */
+    case TLS_PSK_WITH_NULL_SHA:
+      return "TLS_PSK_WITH_NULL_SHA";
+      break;
+    case TLS_DHE_PSK_WITH_NULL_SHA:
+      return "TLS_DHE_PSK_WITH_NULL_SHA";
+      break;
+    case TLS_RSA_PSK_WITH_NULL_SHA:
+      return "TLS_RSA_PSK_WITH_NULL_SHA";
+      break;
+    /* Even more TLS PSK (RFC 5487): */
+    case TLS_PSK_WITH_AES_128_GCM_SHA256:
+      return "TLS_PSK_WITH_AES_128_GCM_SHA256";
+      break;
+    case TLS_PSK_WITH_AES_256_GCM_SHA384:
+      return "TLS_PSK_WITH_AES_256_GCM_SHA384";
+      break;
+    case TLS_DHE_PSK_WITH_AES_128_GCM_SHA256:
+      return "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256";
+      break;
+    case TLS_DHE_PSK_WITH_AES_256_GCM_SHA384:
+      return "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384";
+      break;
+    case TLS_RSA_PSK_WITH_AES_128_GCM_SHA256:
+      return "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256";
+      break;
+    case TLS_RSA_PSK_WITH_AES_256_GCM_SHA384:
+      return "TLS_PSK_WITH_AES_256_GCM_SHA384";
+      break;
+    case TLS_PSK_WITH_AES_128_CBC_SHA256:
+      return "TLS_PSK_WITH_AES_128_CBC_SHA256";
+      break;
+    case TLS_PSK_WITH_AES_256_CBC_SHA384:
+      return "TLS_PSK_WITH_AES_256_CBC_SHA384";
+      break;
+    case TLS_PSK_WITH_NULL_SHA256:
+      return "TLS_PSK_WITH_NULL_SHA256";
+      break;
+    case TLS_PSK_WITH_NULL_SHA384:
+      return "TLS_PSK_WITH_NULL_SHA384";
+      break;
+    case TLS_DHE_PSK_WITH_AES_128_CBC_SHA256:
+      return "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256";
+      break;
+    case TLS_DHE_PSK_WITH_AES_256_CBC_SHA384:
+      return "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384";
+      break;
+    case TLS_DHE_PSK_WITH_NULL_SHA256:
+      return "TLS_DHE_PSK_WITH_NULL_SHA256";
+      break;
+    case TLS_DHE_PSK_WITH_NULL_SHA384:
+      return "TLS_RSA_PSK_WITH_NULL_SHA384";
+      break;
+    case TLS_RSA_PSK_WITH_AES_128_CBC_SHA256:
+      return "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256";
+      break;
+    case TLS_RSA_PSK_WITH_AES_256_CBC_SHA384:
+      return "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384";
+      break;
+    case TLS_RSA_PSK_WITH_NULL_SHA256:
+      return "TLS_RSA_PSK_WITH_NULL_SHA256";
+      break;
+    case TLS_RSA_PSK_WITH_NULL_SHA384:
+      return "TLS_RSA_PSK_WITH_NULL_SHA384";
+      break;
+#endif /* CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7 */
+#if CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11
+    /* New ChaCha20+Poly1305 cipher-suites used by TLS 1.3: */
+    case TLS_AES_128_GCM_SHA256:
+      return "TLS_AES_128_GCM_SHA256";
+      break;
+    case TLS_AES_256_GCM_SHA384:
+      return "TLS_AES_256_GCM_SHA384";
+      break;
+    case TLS_CHACHA20_POLY1305_SHA256:
+      return "TLS_CHACHA20_POLY1305_SHA256";
+      break;
+    case TLS_AES_128_CCM_SHA256:
+      return "TLS_AES_128_CCM_SHA256";
+      break;
+    case TLS_AES_128_CCM_8_SHA256:
+      return "TLS_AES_128_CCM_8_SHA256";
+      break;
+    case TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
+      return "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256";
+      break;
+    case TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:
+      return "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256";
+      break;
+#endif /* CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11 */
+  }
+  return "TLS_NULL_WITH_NULL_NULL";
+}
+#endif /* !CURL_DISABLE_VERBOSE_STRINGS */
+
+#if CURL_BUILD_MAC
+CF_INLINE void GetDarwinVersionNumber(int *major, int *minor)
+{
+  int mib[2];
+  char *os_version;
+  size_t os_version_len;
+  char *os_version_major, *os_version_minor;
+  char *tok_buf;
+
+  /* Get the Darwin kernel version from the kernel using sysctl(): */
+  mib[0] = CTL_KERN;
+  mib[1] = KERN_OSRELEASE;
+  if(sysctl(mib, 2, NULL, &os_version_len, NULL, 0) == -1)
+    return;
+  os_version = malloc(os_version_len*sizeof(char));
+  if(!os_version)
+    return;
+  if(sysctl(mib, 2, os_version, &os_version_len, NULL, 0) == -1) {
+    free(os_version);
+    return;
+  }
+
+  /* Parse the version: */
+  os_version_major = strtok_r(os_version, ".", &tok_buf);
+  os_version_minor = strtok_r(NULL, ".", &tok_buf);
+  *major = atoi(os_version_major);
+  *minor = atoi(os_version_minor);
+  free(os_version);
+}
+#endif /* CURL_BUILD_MAC */
+
+/* Apple provides a myriad of ways of getting information about a certificate
+   into a string. Some aren't available under iOS or newer cats. So here's
+   a unified function for getting a string describing the certificate that
+   ought to work in all cats starting with Leopard. */
+CF_INLINE CFStringRef getsubject(SecCertificateRef cert)
+{
+  CFStringRef server_cert_summary = CFSTR("(null)");
+
+#if CURL_BUILD_IOS
+  /* iOS: There's only one way to do this. */
+  server_cert_summary = SecCertificateCopySubjectSummary(cert);
+#else
+#if CURL_BUILD_MAC_10_7
+  /* Lion & later: Get the long description if we can. */
+  if(SecCertificateCopyLongDescription != NULL)
+    server_cert_summary =
+      SecCertificateCopyLongDescription(NULL, cert, NULL);
+  else
+#endif /* CURL_BUILD_MAC_10_7 */
+#if CURL_BUILD_MAC_10_6
+  /* Snow Leopard: Get the certificate summary. */
+  if(SecCertificateCopySubjectSummary != NULL)
+    server_cert_summary = SecCertificateCopySubjectSummary(cert);
+  else
+#endif /* CURL_BUILD_MAC_10_6 */
+  /* Leopard is as far back as we go... */
+  (void)SecCertificateCopyCommonName(cert, &server_cert_summary);
+#endif /* CURL_BUILD_IOS */
+  return server_cert_summary;
+}
+
+static CURLcode CopyCertSubject(struct Curl_easy *data,
+                                SecCertificateRef cert, char **certp)
+{
+  CFStringRef c = getsubject(cert);
+  CURLcode result = CURLE_OK;
+  const char *direct;
+  char *cbuf = NULL;
+  *certp = NULL;
+
+  if(!c) {
+    failf(data, "SSL: invalid CA certificate subject");
+    return CURLE_PEER_FAILED_VERIFICATION;
+  }
+
+  /* If the subject is already available as UTF-8 encoded (ie 'direct') then
+     use that, else convert it. */
+  direct = CFStringGetCStringPtr(c, kCFStringEncodingUTF8);
+  if(direct) {
+    *certp = strdup(direct);
+    if(!*certp) {
+      failf(data, "SSL: out of memory");
+      result = CURLE_OUT_OF_MEMORY;
+    }
+  }
+  else {
+    size_t cbuf_size = ((size_t)CFStringGetLength(c) * 4) + 1;
+    cbuf = calloc(cbuf_size, 1);
+    if(cbuf) {
+      if(!CFStringGetCString(c, cbuf, cbuf_size,
+                             kCFStringEncodingUTF8)) {
+        failf(data, "SSL: invalid CA certificate subject");
+        result = CURLE_PEER_FAILED_VERIFICATION;
+      }
+      else
+        /* pass back the buffer */
+        *certp = cbuf;
+    }
+    else {
+      failf(data, "SSL: couldn't allocate %zu bytes of memory", cbuf_size);
+      result = CURLE_OUT_OF_MEMORY;
+    }
+  }
+  if(result)
+    free(cbuf);
+  CFRelease(c);
+  return result;
+}
+
+#if CURL_SUPPORT_MAC_10_6
+/* The SecKeychainSearch API was deprecated in Lion, and using it will raise
+   deprecation warnings, so let's not compile this unless it's necessary: */
+static OSStatus CopyIdentityWithLabelOldSchool(char *label,
+                                               SecIdentityRef *out_c_a_k)
+{
+  OSStatus status = errSecItemNotFound;
+  SecKeychainAttributeList attr_list;
+  SecKeychainAttribute attr;
+  SecKeychainSearchRef search = NULL;
+  SecCertificateRef cert = NULL;
+
+  /* Set up the attribute list: */
+  attr_list.count = 1L;
+  attr_list.attr = &attr;
+
+  /* Set up our lone search criterion: */
+  attr.tag = kSecLabelItemAttr;
+  attr.data = label;
+  attr.length = (UInt32)strlen(label);
+
+  /* Start searching: */
+  status = SecKeychainSearchCreateFromAttributes(NULL,
+                                                 kSecCertificateItemClass,
+                                                 &attr_list,
+                                                 &search);
+  if(status == noErr) {
+    status = SecKeychainSearchCopyNext(search,
+                                       (SecKeychainItemRef *)&cert);
+    if(status == noErr && cert) {
+      /* If we found a certificate, does it have a private key? */
+      status = SecIdentityCreateWithCertificate(NULL, cert, out_c_a_k);
+      CFRelease(cert);
+    }
+  }
+
+  if(search)
+    CFRelease(search);
+  return status;
+}
+#endif /* CURL_SUPPORT_MAC_10_6 */
+
+static OSStatus CopyIdentityWithLabel(char *label,
+                                      SecIdentityRef *out_cert_and_key)
+{
+  OSStatus status = errSecItemNotFound;
+
+#if CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS
+  CFArrayRef keys_list;
+  CFIndex keys_list_count;
+  CFIndex i;
+  CFStringRef common_name;
+
+  /* SecItemCopyMatching() was introduced in iOS and Snow Leopard.
+     kSecClassIdentity was introduced in Lion. If both exist, let's use them
+     to find the certificate. */
+  if(SecItemCopyMatching != NULL && kSecClassIdentity != NULL) {
+    CFTypeRef keys[5];
+    CFTypeRef values[5];
+    CFDictionaryRef query_dict;
+    CFStringRef label_cf = CFStringCreateWithCString(NULL, label,
+      kCFStringEncodingUTF8);
+
+    /* Set up our search criteria and expected results: */
+    values[0] = kSecClassIdentity; /* we want a certificate and a key */
+    keys[0] = kSecClass;
+    values[1] = kCFBooleanTrue;    /* we want a reference */
+    keys[1] = kSecReturnRef;
+    values[2] = kSecMatchLimitAll; /* kSecMatchLimitOne would be better if the
+                                    * label matching below worked correctly */
+    keys[2] = kSecMatchLimit;
+    /* identity searches need a SecPolicyRef in order to work */
+    values[3] = SecPolicyCreateSSL(false, NULL);
+    keys[3] = kSecMatchPolicy;
+    /* match the name of the certificate (doesn't work in macOS 10.12.1) */
+    values[4] = label_cf;
+    keys[4] = kSecAttrLabel;
+    query_dict = CFDictionaryCreate(NULL, (const void **)keys,
+                                    (const void **)values, 5L,
+                                    &kCFCopyStringDictionaryKeyCallBacks,
+                                    &kCFTypeDictionaryValueCallBacks);
+    CFRelease(values[3]);
+
+    /* Do we have a match? */
+    status = SecItemCopyMatching(query_dict, (CFTypeRef *) &keys_list);
+
+    /* Because kSecAttrLabel matching doesn't work with kSecClassIdentity,
+     * we need to find the correct identity ourselves */
+    if(status == noErr) {
+      keys_list_count = CFArrayGetCount(keys_list);
+      *out_cert_and_key = NULL;
+      status = 1;
+      for(i = 0; i<keys_list_count; i++) {
+        OSStatus err = noErr;
+        SecCertificateRef cert = NULL;
+        SecIdentityRef identity =
+          (SecIdentityRef) CFArrayGetValueAtIndex(keys_list, i);
+        err = SecIdentityCopyCertificate(identity, &cert);
+        if(err == noErr) {
+#if CURL_BUILD_IOS
+          common_name = SecCertificateCopySubjectSummary(cert);
+#elif CURL_BUILD_MAC_10_7
+          SecCertificateCopyCommonName(cert, &common_name);
+#endif
+          if(CFStringCompare(common_name, label_cf, 0) == kCFCompareEqualTo) {
+            CFRelease(cert);
+            CFRelease(common_name);
+            CFRetain(identity);
+            *out_cert_and_key = identity;
+            status = noErr;
+            break;
+          }
+          CFRelease(common_name);
+        }
+        CFRelease(cert);
+      }
+    }
+
+    if(keys_list)
+      CFRelease(keys_list);
+    CFRelease(query_dict);
+    CFRelease(label_cf);
+  }
+  else {
+#if CURL_SUPPORT_MAC_10_6
+    /* On Leopard and Snow Leopard, fall back to SecKeychainSearch. */
+    status = CopyIdentityWithLabelOldSchool(label, out_cert_and_key);
+#endif /* CURL_SUPPORT_MAC_10_6 */
+  }
+#elif CURL_SUPPORT_MAC_10_6
+  /* For developers building on older cats, we have no choice but to fall back
+     to SecKeychainSearch. */
+  status = CopyIdentityWithLabelOldSchool(label, out_cert_and_key);
+#endif /* CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS */
+  return status;
+}
+
+static OSStatus CopyIdentityFromPKCS12File(const char *cPath,
                                            const struct curl_blob *blob,
-                                           const char *cPassword, 
-                                           SecIdentityRef *out_cert_and_key) 
-{ 
-  OSStatus status = errSecItemNotFound; 
+                                           const char *cPassword,
+                                           SecIdentityRef *out_cert_and_key)
+{
+  OSStatus status = errSecItemNotFound;
   CFURLRef pkcs_url = NULL;
-  CFStringRef password = cPassword ? CFStringCreateWithCString(NULL, 
-    cPassword, kCFStringEncodingUTF8) : NULL; 
-  CFDataRef pkcs_data = NULL; 
- 
-  /* We can import P12 files on iOS or OS X 10.7 or later: */ 
-  /* These constants are documented as having first appeared in 10.6 but they 
-     raise linker errors when used on that cat for some reason. */ 
-#if CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS 
+  CFStringRef password = cPassword ? CFStringCreateWithCString(NULL,
+    cPassword, kCFStringEncodingUTF8) : NULL;
+  CFDataRef pkcs_data = NULL;
+
+  /* We can import P12 files on iOS or OS X 10.7 or later: */
+  /* These constants are documented as having first appeared in 10.6 but they
+     raise linker errors when used on that cat for some reason. */
+#if CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS
   bool resource_imported;
 
   if(blob) {
@@ -1160,2167 +1160,2167 @@ static OSStatus CopyIdentityFromPKCS12File(const char *cPath,
   }
 
   if(resource_imported) {
-    CFArrayRef items = NULL; 
- 
-  /* On iOS SecPKCS12Import will never add the client certificate to the 
-   * Keychain. 
-   * 
-   * It gives us back a SecIdentityRef that we can use directly. */ 
-#if CURL_BUILD_IOS 
-    const void *cKeys[] = {kSecImportExportPassphrase}; 
-    const void *cValues[] = {password}; 
-    CFDictionaryRef options = CFDictionaryCreate(NULL, cKeys, cValues, 
-      password ? 1L : 0L, NULL, NULL); 
- 
-    if(options != NULL) { 
-      status = SecPKCS12Import(pkcs_data, options, &items); 
-      CFRelease(options); 
-    } 
- 
- 
-  /* On macOS SecPKCS12Import will always add the client certificate to 
-   * the Keychain. 
-   * 
-   * As this doesn't match iOS, and apps may not want to see their client 
+    CFArrayRef items = NULL;
+
+  /* On iOS SecPKCS12Import will never add the client certificate to the
+   * Keychain.
+   *
+   * It gives us back a SecIdentityRef that we can use directly. */
+#if CURL_BUILD_IOS
+    const void *cKeys[] = {kSecImportExportPassphrase};
+    const void *cValues[] = {password};
+    CFDictionaryRef options = CFDictionaryCreate(NULL, cKeys, cValues,
+      password ? 1L : 0L, NULL, NULL);
+
+    if(options != NULL) {
+      status = SecPKCS12Import(pkcs_data, options, &items);
+      CFRelease(options);
+    }
+
+
+  /* On macOS SecPKCS12Import will always add the client certificate to
+   * the Keychain.
+   *
+   * As this doesn't match iOS, and apps may not want to see their client
    * certificate saved in the user's keychain, we use SecItemImport
-   * with a NULL keychain to avoid importing it. 
-   * 
-   * This returns a SecCertificateRef from which we can construct a 
-   * SecIdentityRef. 
-   */ 
-#elif CURL_BUILD_MAC_10_7 
-    SecItemImportExportKeyParameters keyParams; 
-    SecExternalFormat inputFormat = kSecFormatPKCS12; 
-    SecExternalItemType inputType = kSecItemTypeCertificate; 
- 
-    memset(&keyParams, 0x00, sizeof(keyParams)); 
-    keyParams.version    = SEC_KEY_IMPORT_EXPORT_PARAMS_VERSION; 
-    keyParams.passphrase = password; 
- 
-    status = SecItemImport(pkcs_data, NULL, &inputFormat, &inputType, 
-                           0, &keyParams, NULL, &items); 
-#endif 
- 
- 
-    /* Extract the SecIdentityRef */ 
-    if(status == errSecSuccess && items && CFArrayGetCount(items)) { 
-      CFIndex i, count; 
-      count = CFArrayGetCount(items); 
- 
-      for(i = 0; i < count; i++) { 
-        CFTypeRef item = (CFTypeRef) CFArrayGetValueAtIndex(items, i); 
-        CFTypeID  itemID = CFGetTypeID(item); 
- 
-        if(itemID == CFDictionaryGetTypeID()) { 
-          CFTypeRef identity = (CFTypeRef) CFDictionaryGetValue( 
-                                                 (CFDictionaryRef) item, 
-                                                 kSecImportItemIdentity); 
-          CFRetain(identity); 
-          *out_cert_and_key = (SecIdentityRef) identity; 
-          break; 
-        } 
-#if CURL_BUILD_MAC_10_7 
-        else if(itemID == SecCertificateGetTypeID()) { 
-          status = SecIdentityCreateWithCertificate(NULL, 
-                                                 (SecCertificateRef) item, 
-                                                 out_cert_and_key); 
-          break; 
-        } 
-#endif 
-      } 
-    } 
- 
-    if(items) 
-      CFRelease(items); 
-    CFRelease(pkcs_data); 
-  } 
-#endif /* CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS */ 
-  if(password) 
-    CFRelease(password); 
+   * with a NULL keychain to avoid importing it.
+   *
+   * This returns a SecCertificateRef from which we can construct a
+   * SecIdentityRef.
+   */
+#elif CURL_BUILD_MAC_10_7
+    SecItemImportExportKeyParameters keyParams;
+    SecExternalFormat inputFormat = kSecFormatPKCS12;
+    SecExternalItemType inputType = kSecItemTypeCertificate;
+
+    memset(&keyParams, 0x00, sizeof(keyParams));
+    keyParams.version    = SEC_KEY_IMPORT_EXPORT_PARAMS_VERSION;
+    keyParams.passphrase = password;
+
+    status = SecItemImport(pkcs_data, NULL, &inputFormat, &inputType,
+                           0, &keyParams, NULL, &items);
+#endif
+
+
+    /* Extract the SecIdentityRef */
+    if(status == errSecSuccess && items && CFArrayGetCount(items)) {
+      CFIndex i, count;
+      count = CFArrayGetCount(items);
+
+      for(i = 0; i < count; i++) {
+        CFTypeRef item = (CFTypeRef) CFArrayGetValueAtIndex(items, i);
+        CFTypeID  itemID = CFGetTypeID(item);
+
+        if(itemID == CFDictionaryGetTypeID()) {
+          CFTypeRef identity = (CFTypeRef) CFDictionaryGetValue(
+                                                 (CFDictionaryRef) item,
+                                                 kSecImportItemIdentity);
+          CFRetain(identity);
+          *out_cert_and_key = (SecIdentityRef) identity;
+          break;
+        }
+#if CURL_BUILD_MAC_10_7
+        else if(itemID == SecCertificateGetTypeID()) {
+          status = SecIdentityCreateWithCertificate(NULL,
+                                                 (SecCertificateRef) item,
+                                                 out_cert_and_key);
+          break;
+        }
+#endif
+      }
+    }
+
+    if(items)
+      CFRelease(items);
+    CFRelease(pkcs_data);
+  }
+#endif /* CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS */
+  if(password)
+    CFRelease(password);
   if(pkcs_url)
     CFRelease(pkcs_url);
-  return status; 
-} 
- 
-/* This code was borrowed from nss.c, with some modifications: 
- * Determine whether the nickname passed in is a filename that needs to 
- * be loaded as a PEM or a regular NSS nickname. 
- * 
- * returns 1 for a file 
- * returns 0 for not a file 
- */ 
-CF_INLINE bool is_file(const char *filename) 
-{ 
-  struct_stat st; 
- 
-  if(filename == NULL) 
-    return false; 
- 
-  if(stat(filename, &st) == 0) 
-    return S_ISREG(st.st_mode); 
-  return false; 
-} 
- 
-#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS 
-static CURLcode sectransp_version_from_curl(SSLProtocol *darwinver, 
-                                            long ssl_version) 
-{ 
-  switch(ssl_version) { 
-    case CURL_SSLVERSION_TLSv1_0: 
-      *darwinver = kTLSProtocol1; 
-      return CURLE_OK; 
-    case CURL_SSLVERSION_TLSv1_1: 
-      *darwinver = kTLSProtocol11; 
-      return CURLE_OK; 
-    case CURL_SSLVERSION_TLSv1_2: 
-      *darwinver = kTLSProtocol12; 
-      return CURLE_OK; 
-    case CURL_SSLVERSION_TLSv1_3: 
-      /* TLS 1.3 support first appeared in iOS 11 and macOS 10.13 */ 
-#if (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) && HAVE_BUILTIN_AVAILABLE == 1 
-      if(__builtin_available(macOS 10.13, iOS 11.0, *)) { 
-        *darwinver = kTLSProtocol13; 
-        return CURLE_OK; 
-      } 
-#endif /* (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) && 
-          HAVE_BUILTIN_AVAILABLE == 1 */ 
-      break; 
-  } 
-  return CURLE_SSL_CONNECT_ERROR; 
-} 
-#endif 
- 
-static CURLcode 
-set_ssl_version_min_max(struct connectdata *conn, int sockindex) 
-{ 
-  struct Curl_easy *data = conn->data; 
-  struct ssl_connect_data *connssl = &conn->ssl[sockindex]; 
+  return status;
+}
+
+/* This code was borrowed from nss.c, with some modifications:
+ * Determine whether the nickname passed in is a filename that needs to
+ * be loaded as a PEM or a regular NSS nickname.
+ *
+ * returns 1 for a file
+ * returns 0 for not a file
+ */
+CF_INLINE bool is_file(const char *filename)
+{
+  struct_stat st;
+
+  if(filename == NULL)
+    return false;
+
+  if(stat(filename, &st) == 0)
+    return S_ISREG(st.st_mode);
+  return false;
+}
+
+#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
+static CURLcode sectransp_version_from_curl(SSLProtocol *darwinver,
+                                            long ssl_version)
+{
+  switch(ssl_version) {
+    case CURL_SSLVERSION_TLSv1_0:
+      *darwinver = kTLSProtocol1;
+      return CURLE_OK;
+    case CURL_SSLVERSION_TLSv1_1:
+      *darwinver = kTLSProtocol11;
+      return CURLE_OK;
+    case CURL_SSLVERSION_TLSv1_2:
+      *darwinver = kTLSProtocol12;
+      return CURLE_OK;
+    case CURL_SSLVERSION_TLSv1_3:
+      /* TLS 1.3 support first appeared in iOS 11 and macOS 10.13 */
+#if (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) && HAVE_BUILTIN_AVAILABLE == 1
+      if(__builtin_available(macOS 10.13, iOS 11.0, *)) {
+        *darwinver = kTLSProtocol13;
+        return CURLE_OK;
+      }
+#endif /* (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) &&
+          HAVE_BUILTIN_AVAILABLE == 1 */
+      break;
+  }
+  return CURLE_SSL_CONNECT_ERROR;
+}
+#endif
+
+static CURLcode
+set_ssl_version_min_max(struct connectdata *conn, int sockindex)
+{
+  struct Curl_easy *data = conn->data;
+  struct ssl_connect_data *connssl = &conn->ssl[sockindex];
   struct ssl_backend_data *backend = connssl->backend;
-  long ssl_version = SSL_CONN_CONFIG(version); 
-  long ssl_version_max = SSL_CONN_CONFIG(version_max); 
-  long max_supported_version_by_os; 
- 
-  /* macOS 10.5-10.7 supported TLS 1.0 only. 
-     macOS 10.8 and later, and iOS 5 and later, added TLS 1.1 and 1.2. 
-     macOS 10.13 and later, and iOS 11 and later, added TLS 1.3. */ 
-#if (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) && HAVE_BUILTIN_AVAILABLE == 1 
-  if(__builtin_available(macOS 10.13, iOS 11.0, *)) { 
-    max_supported_version_by_os = CURL_SSLVERSION_MAX_TLSv1_3; 
-  } 
-  else { 
-    max_supported_version_by_os = CURL_SSLVERSION_MAX_TLSv1_2; 
-  } 
-#else 
-  max_supported_version_by_os = CURL_SSLVERSION_MAX_TLSv1_2; 
-#endif /* (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) && 
-          HAVE_BUILTIN_AVAILABLE == 1 */ 
- 
-  switch(ssl_version) { 
-    case CURL_SSLVERSION_DEFAULT: 
-    case CURL_SSLVERSION_TLSv1: 
-      ssl_version = CURL_SSLVERSION_TLSv1_0; 
-      break; 
-  } 
- 
-  switch(ssl_version_max) { 
-    case CURL_SSLVERSION_MAX_NONE: 
-    case CURL_SSLVERSION_MAX_DEFAULT: 
-      ssl_version_max = max_supported_version_by_os; 
-      break; 
-  } 
- 
-#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS 
-  if(SSLSetProtocolVersionMax != NULL) { 
-    SSLProtocol darwin_ver_min = kTLSProtocol1; 
-    SSLProtocol darwin_ver_max = kTLSProtocol1; 
-    CURLcode result = sectransp_version_from_curl(&darwin_ver_min, 
-                                                  ssl_version); 
-    if(result) { 
-      failf(data, "unsupported min version passed via CURLOPT_SSLVERSION"); 
-      return result; 
-    } 
-    result = sectransp_version_from_curl(&darwin_ver_max, 
-                                         ssl_version_max >> 16); 
-    if(result) { 
-      failf(data, "unsupported max version passed via CURLOPT_SSLVERSION"); 
-      return result; 
-    } 
- 
+  long ssl_version = SSL_CONN_CONFIG(version);
+  long ssl_version_max = SSL_CONN_CONFIG(version_max);
+  long max_supported_version_by_os;
+
+  /* macOS 10.5-10.7 supported TLS 1.0 only.
+     macOS 10.8 and later, and iOS 5 and later, added TLS 1.1 and 1.2.
+     macOS 10.13 and later, and iOS 11 and later, added TLS 1.3. */
+#if (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) && HAVE_BUILTIN_AVAILABLE == 1
+  if(__builtin_available(macOS 10.13, iOS 11.0, *)) {
+    max_supported_version_by_os = CURL_SSLVERSION_MAX_TLSv1_3;
+  }
+  else {
+    max_supported_version_by_os = CURL_SSLVERSION_MAX_TLSv1_2;
+  }
+#else
+  max_supported_version_by_os = CURL_SSLVERSION_MAX_TLSv1_2;
+#endif /* (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) &&
+          HAVE_BUILTIN_AVAILABLE == 1 */
+
+  switch(ssl_version) {
+    case CURL_SSLVERSION_DEFAULT:
+    case CURL_SSLVERSION_TLSv1:
+      ssl_version = CURL_SSLVERSION_TLSv1_0;
+      break;
+  }
+
+  switch(ssl_version_max) {
+    case CURL_SSLVERSION_MAX_NONE:
+    case CURL_SSLVERSION_MAX_DEFAULT:
+      ssl_version_max = max_supported_version_by_os;
+      break;
+  }
+
+#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
+  if(SSLSetProtocolVersionMax != NULL) {
+    SSLProtocol darwin_ver_min = kTLSProtocol1;
+    SSLProtocol darwin_ver_max = kTLSProtocol1;
+    CURLcode result = sectransp_version_from_curl(&darwin_ver_min,
+                                                  ssl_version);
+    if(result) {
+      failf(data, "unsupported min version passed via CURLOPT_SSLVERSION");
+      return result;
+    }
+    result = sectransp_version_from_curl(&darwin_ver_max,
+                                         ssl_version_max >> 16);
+    if(result) {
+      failf(data, "unsupported max version passed via CURLOPT_SSLVERSION");
+      return result;
+    }
+
     (void)SSLSetProtocolVersionMin(backend->ssl_ctx, darwin_ver_min);
     (void)SSLSetProtocolVersionMax(backend->ssl_ctx, darwin_ver_max);
-    return result; 
-  } 
-  else { 
-#if CURL_SUPPORT_MAC_10_8 
-    long i = ssl_version; 
+    return result;
+  }
+  else {
+#if CURL_SUPPORT_MAC_10_8
+    long i = ssl_version;
     (void)SSLSetProtocolVersionEnabled(backend->ssl_ctx,
-                                       kSSLProtocolAll, 
-                                       false); 
-    for(; i <= (ssl_version_max >> 16); i++) { 
-      switch(i) { 
-        case CURL_SSLVERSION_TLSv1_0: 
+                                       kSSLProtocolAll,
+                                       false);
+    for(; i <= (ssl_version_max >> 16); i++) {
+      switch(i) {
+        case CURL_SSLVERSION_TLSv1_0:
           (void)SSLSetProtocolVersionEnabled(backend->ssl_ctx,
-                                            kTLSProtocol1, 
-                                            true); 
-          break; 
-        case CURL_SSLVERSION_TLSv1_1: 
+                                            kTLSProtocol1,
+                                            true);
+          break;
+        case CURL_SSLVERSION_TLSv1_1:
           (void)SSLSetProtocolVersionEnabled(backend->ssl_ctx,
-                                            kTLSProtocol11, 
-                                            true); 
-          break; 
-        case CURL_SSLVERSION_TLSv1_2: 
+                                            kTLSProtocol11,
+                                            true);
+          break;
+        case CURL_SSLVERSION_TLSv1_2:
           (void)SSLSetProtocolVersionEnabled(backend->ssl_ctx,
-                                            kTLSProtocol12, 
-                                            true); 
-          break; 
-        case CURL_SSLVERSION_TLSv1_3: 
-          failf(data, "Your version of the OS does not support TLSv1.3"); 
-          return CURLE_SSL_CONNECT_ERROR; 
-      } 
-    } 
-    return CURLE_OK; 
-#endif  /* CURL_SUPPORT_MAC_10_8 */ 
-  } 
-#endif  /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */ 
-  failf(data, "Secure Transport: cannot set SSL protocol"); 
-  return CURLE_SSL_CONNECT_ERROR; 
-} 
- 
- 
-static CURLcode sectransp_connect_step1(struct connectdata *conn, 
-                                        int sockindex) 
-{ 
-  struct Curl_easy *data = conn->data; 
-  curl_socket_t sockfd = conn->sock[sockindex]; 
-  struct ssl_connect_data *connssl = &conn->ssl[sockindex]; 
+                                            kTLSProtocol12,
+                                            true);
+          break;
+        case CURL_SSLVERSION_TLSv1_3:
+          failf(data, "Your version of the OS does not support TLSv1.3");
+          return CURLE_SSL_CONNECT_ERROR;
+      }
+    }
+    return CURLE_OK;
+#endif  /* CURL_SUPPORT_MAC_10_8 */
+  }
+#endif  /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */
+  failf(data, "Secure Transport: cannot set SSL protocol");
+  return CURLE_SSL_CONNECT_ERROR;
+}
+
+
+static CURLcode sectransp_connect_step1(struct connectdata *conn,
+                                        int sockindex)
+{
+  struct Curl_easy *data = conn->data;
+  curl_socket_t sockfd = conn->sock[sockindex];
+  struct ssl_connect_data *connssl = &conn->ssl[sockindex];
   struct ssl_backend_data *backend = connssl->backend;
-  const char * const ssl_cafile = SSL_CONN_CONFIG(CAfile); 
+  const char * const ssl_cafile = SSL_CONN_CONFIG(CAfile);
   const struct curl_blob *ssl_cablob = NULL;
-  const bool verifypeer = SSL_CONN_CONFIG(verifypeer); 
+  const bool verifypeer = SSL_CONN_CONFIG(verifypeer);
   char * const ssl_cert = SSL_SET_OPTION(primary.clientcert);
   const struct curl_blob *ssl_cert_blob = SSL_SET_OPTION(primary.cert_blob);
 #ifndef CURL_DISABLE_PROXY
-  const char * const hostname = SSL_IS_PROXY() ? conn->http_proxy.host.name : 
-    conn->host.name; 
-  const long int port = SSL_IS_PROXY() ? conn->port : conn->remote_port; 
+  const char * const hostname = SSL_IS_PROXY() ? conn->http_proxy.host.name :
+    conn->host.name;
+  const long int port = SSL_IS_PROXY() ? conn->port : conn->remote_port;
 #else
   const char * const hostname = conn->host.name;
   const long int port = conn->remote_port;
 #endif
-#ifdef ENABLE_IPV6 
-  struct in6_addr addr; 
-#else 
-  struct in_addr addr; 
-#endif /* ENABLE_IPV6 */ 
-  size_t all_ciphers_count = 0UL, allowed_ciphers_count = 0UL, i; 
-  SSLCipherSuite *all_ciphers = NULL, *allowed_ciphers = NULL; 
-  OSStatus err = noErr; 
-#if CURL_BUILD_MAC 
-  int darwinver_maj = 0, darwinver_min = 0; 
- 
-  GetDarwinVersionNumber(&darwinver_maj, &darwinver_min); 
-#endif /* CURL_BUILD_MAC */ 
- 
-#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS 
-  if(SSLCreateContext != NULL) {  /* use the newer API if available */ 
+#ifdef ENABLE_IPV6
+  struct in6_addr addr;
+#else
+  struct in_addr addr;
+#endif /* ENABLE_IPV6 */
+  size_t all_ciphers_count = 0UL, allowed_ciphers_count = 0UL, i;
+  SSLCipherSuite *all_ciphers = NULL, *allowed_ciphers = NULL;
+  OSStatus err = noErr;
+#if CURL_BUILD_MAC
+  int darwinver_maj = 0, darwinver_min = 0;
+
+  GetDarwinVersionNumber(&darwinver_maj, &darwinver_min);
+#endif /* CURL_BUILD_MAC */
+
+#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
+  if(SSLCreateContext != NULL) {  /* use the newer API if available */
     if(backend->ssl_ctx)
       CFRelease(backend->ssl_ctx);
     backend->ssl_ctx = SSLCreateContext(NULL, kSSLClientSide, kSSLStreamType);
     if(!backend->ssl_ctx) {
-      failf(data, "SSL: couldn't create a context!"); 
-      return CURLE_OUT_OF_MEMORY; 
-    } 
-  } 
-  else { 
-  /* The old ST API does not exist under iOS, so don't compile it: */ 
-#if CURL_SUPPORT_MAC_10_8 
+      failf(data, "SSL: couldn't create a context!");
+      return CURLE_OUT_OF_MEMORY;
+    }
+  }
+  else {
+  /* The old ST API does not exist under iOS, so don't compile it: */
+#if CURL_SUPPORT_MAC_10_8
     if(backend->ssl_ctx)
       (void)SSLDisposeContext(backend->ssl_ctx);
     err = SSLNewContext(false, &(backend->ssl_ctx));
-    if(err != noErr) { 
-      failf(data, "SSL: couldn't create a context: OSStatus %d", err); 
-      return CURLE_OUT_OF_MEMORY; 
-    } 
-#endif /* CURL_SUPPORT_MAC_10_8 */ 
-  } 
-#else 
+    if(err != noErr) {
+      failf(data, "SSL: couldn't create a context: OSStatus %d", err);
+      return CURLE_OUT_OF_MEMORY;
+    }
+#endif /* CURL_SUPPORT_MAC_10_8 */
+  }
+#else
   if(backend->ssl_ctx)
     (void)SSLDisposeContext(backend->ssl_ctx);
   err = SSLNewContext(false, &(backend->ssl_ctx));
-  if(err != noErr) { 
-    failf(data, "SSL: couldn't create a context: OSStatus %d", err); 
-    return CURLE_OUT_OF_MEMORY; 
-  } 
-#endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */ 
+  if(err != noErr) {
+    failf(data, "SSL: couldn't create a context: OSStatus %d", err);
+    return CURLE_OUT_OF_MEMORY;
+  }
+#endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */
   backend->ssl_write_buffered_length = 0UL; /* reset buffered write length */
- 
-  /* check to see if we've been told to use an explicit SSL/TLS version */ 
-#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS 
-  if(SSLSetProtocolVersionMax != NULL) { 
-    switch(conn->ssl_config.version) { 
-    case CURL_SSLVERSION_TLSv1: 
+
+  /* check to see if we've been told to use an explicit SSL/TLS version */
+#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
+  if(SSLSetProtocolVersionMax != NULL) {
+    switch(conn->ssl_config.version) {
+    case CURL_SSLVERSION_TLSv1:
       (void)SSLSetProtocolVersionMin(backend->ssl_ctx, kTLSProtocol1);
-#if (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) && HAVE_BUILTIN_AVAILABLE == 1 
-      if(__builtin_available(macOS 10.13, iOS 11.0, *)) { 
+#if (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) && HAVE_BUILTIN_AVAILABLE == 1
+      if(__builtin_available(macOS 10.13, iOS 11.0, *)) {
         (void)SSLSetProtocolVersionMax(backend->ssl_ctx, kTLSProtocol13);
-      } 
-      else { 
+      }
+      else {
         (void)SSLSetProtocolVersionMax(backend->ssl_ctx, kTLSProtocol12);
-      } 
-#else 
+      }
+#else
       (void)SSLSetProtocolVersionMax(backend->ssl_ctx, kTLSProtocol12);
-#endif /* (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) && 
-          HAVE_BUILTIN_AVAILABLE == 1 */ 
-      break; 
-    case CURL_SSLVERSION_DEFAULT: 
-    case CURL_SSLVERSION_TLSv1_0: 
-    case CURL_SSLVERSION_TLSv1_1: 
-    case CURL_SSLVERSION_TLSv1_2: 
-    case CURL_SSLVERSION_TLSv1_3: 
-      { 
-        CURLcode result = set_ssl_version_min_max(conn, sockindex); 
-        if(result != CURLE_OK) 
-          return result; 
-        break; 
-      } 
-    case CURL_SSLVERSION_SSLv3: 
+#endif /* (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) &&
+          HAVE_BUILTIN_AVAILABLE == 1 */
+      break;
+    case CURL_SSLVERSION_DEFAULT:
+    case CURL_SSLVERSION_TLSv1_0:
+    case CURL_SSLVERSION_TLSv1_1:
+    case CURL_SSLVERSION_TLSv1_2:
+    case CURL_SSLVERSION_TLSv1_3:
+      {
+        CURLcode result = set_ssl_version_min_max(conn, sockindex);
+        if(result != CURLE_OK)
+          return result;
+        break;
+      }
+    case CURL_SSLVERSION_SSLv3:
       err = SSLSetProtocolVersionMin(backend->ssl_ctx, kSSLProtocol3);
-      if(err != noErr) { 
-        failf(data, "Your version of the OS does not support SSLv3"); 
-        return CURLE_SSL_CONNECT_ERROR; 
-      } 
+      if(err != noErr) {
+        failf(data, "Your version of the OS does not support SSLv3");
+        return CURLE_SSL_CONNECT_ERROR;
+      }
       (void)SSLSetProtocolVersionMax(backend->ssl_ctx, kSSLProtocol3);
-      break; 
-    case CURL_SSLVERSION_SSLv2: 
+      break;
+    case CURL_SSLVERSION_SSLv2:
       err = SSLSetProtocolVersionMin(backend->ssl_ctx, kSSLProtocol2);
-      if(err != noErr) { 
-        failf(data, "Your version of the OS does not support SSLv2"); 
-        return CURLE_SSL_CONNECT_ERROR; 
-      } 
+      if(err != noErr) {
+        failf(data, "Your version of the OS does not support SSLv2");
+        return CURLE_SSL_CONNECT_ERROR;
+      }
       (void)SSLSetProtocolVersionMax(backend->ssl_ctx, kSSLProtocol2);
-      break; 
-    default: 
-      failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION"); 
-      return CURLE_SSL_CONNECT_ERROR; 
-    } 
-  } 
-  else { 
-#if CURL_SUPPORT_MAC_10_8 
+      break;
+    default:
+      failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION");
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+  }
+  else {
+#if CURL_SUPPORT_MAC_10_8
     (void)SSLSetProtocolVersionEnabled(backend->ssl_ctx,
-                                       kSSLProtocolAll, 
-                                       false); 
-    switch(conn->ssl_config.version) { 
-    case CURL_SSLVERSION_DEFAULT: 
-    case CURL_SSLVERSION_TLSv1: 
+                                       kSSLProtocolAll,
+                                       false);
+    switch(conn->ssl_config.version) {
+    case CURL_SSLVERSION_DEFAULT:
+    case CURL_SSLVERSION_TLSv1:
       (void)SSLSetProtocolVersionEnabled(backend->ssl_ctx,
-                                         kTLSProtocol1, 
-                                         true); 
+                                         kTLSProtocol1,
+                                         true);
       (void)SSLSetProtocolVersionEnabled(backend->ssl_ctx,
-                                         kTLSProtocol11, 
-                                         true); 
+                                         kTLSProtocol11,
+                                         true);
       (void)SSLSetProtocolVersionEnabled(backend->ssl_ctx,
-                                         kTLSProtocol12, 
-                                         true); 
-      break; 
-    case CURL_SSLVERSION_TLSv1_0: 
-    case CURL_SSLVERSION_TLSv1_1: 
-    case CURL_SSLVERSION_TLSv1_2: 
-    case CURL_SSLVERSION_TLSv1_3: 
-      { 
-        CURLcode result = set_ssl_version_min_max(conn, sockindex); 
-        if(result != CURLE_OK) 
-          return result; 
-        break; 
-      } 
-    case CURL_SSLVERSION_SSLv3: 
+                                         kTLSProtocol12,
+                                         true);
+      break;
+    case CURL_SSLVERSION_TLSv1_0:
+    case CURL_SSLVERSION_TLSv1_1:
+    case CURL_SSLVERSION_TLSv1_2:
+    case CURL_SSLVERSION_TLSv1_3:
+      {
+        CURLcode result = set_ssl_version_min_max(conn, sockindex);
+        if(result != CURLE_OK)
+          return result;
+        break;
+      }
+    case CURL_SSLVERSION_SSLv3:
       err = SSLSetProtocolVersionEnabled(backend->ssl_ctx,
-                                         kSSLProtocol3, 
-                                         true); 
-      if(err != noErr) { 
-        failf(data, "Your version of the OS does not support SSLv3"); 
-        return CURLE_SSL_CONNECT_ERROR; 
-      } 
-      break; 
-    case CURL_SSLVERSION_SSLv2: 
+                                         kSSLProtocol3,
+                                         true);
+      if(err != noErr) {
+        failf(data, "Your version of the OS does not support SSLv3");
+        return CURLE_SSL_CONNECT_ERROR;
+      }
+      break;
+    case CURL_SSLVERSION_SSLv2:
       err = SSLSetProtocolVersionEnabled(backend->ssl_ctx,
-                                         kSSLProtocol2, 
-                                         true); 
-      if(err != noErr) { 
-        failf(data, "Your version of the OS does not support SSLv2"); 
-        return CURLE_SSL_CONNECT_ERROR; 
-      } 
-      break; 
-    default: 
-      failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION"); 
-      return CURLE_SSL_CONNECT_ERROR; 
-    } 
-#endif  /* CURL_SUPPORT_MAC_10_8 */ 
-  } 
-#else 
-  if(conn->ssl_config.version_max != CURL_SSLVERSION_MAX_NONE) { 
-    failf(data, "Your version of the OS does not support to set maximum" 
-                " SSL/TLS version"); 
-    return CURLE_SSL_CONNECT_ERROR; 
-  } 
+                                         kSSLProtocol2,
+                                         true);
+      if(err != noErr) {
+        failf(data, "Your version of the OS does not support SSLv2");
+        return CURLE_SSL_CONNECT_ERROR;
+      }
+      break;
+    default:
+      failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION");
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+#endif  /* CURL_SUPPORT_MAC_10_8 */
+  }
+#else
+  if(conn->ssl_config.version_max != CURL_SSLVERSION_MAX_NONE) {
+    failf(data, "Your version of the OS does not support to set maximum"
+                " SSL/TLS version");
+    return CURLE_SSL_CONNECT_ERROR;
+  }
   (void)SSLSetProtocolVersionEnabled(backend->ssl_ctx, kSSLProtocolAll, false);
-  switch(conn->ssl_config.version) { 
-  case CURL_SSLVERSION_DEFAULT: 
-  case CURL_SSLVERSION_TLSv1: 
-  case CURL_SSLVERSION_TLSv1_0: 
+  switch(conn->ssl_config.version) {
+  case CURL_SSLVERSION_DEFAULT:
+  case CURL_SSLVERSION_TLSv1:
+  case CURL_SSLVERSION_TLSv1_0:
     (void)SSLSetProtocolVersionEnabled(backend->ssl_ctx,
-                                       kTLSProtocol1, 
-                                       true); 
-    break; 
-  case CURL_SSLVERSION_TLSv1_1: 
-    failf(data, "Your version of the OS does not support TLSv1.1"); 
-    return CURLE_SSL_CONNECT_ERROR; 
-  case CURL_SSLVERSION_TLSv1_2: 
-    failf(data, "Your version of the OS does not support TLSv1.2"); 
-    return CURLE_SSL_CONNECT_ERROR; 
-  case CURL_SSLVERSION_TLSv1_3: 
-    failf(data, "Your version of the OS does not support TLSv1.3"); 
-    return CURLE_SSL_CONNECT_ERROR; 
-  case CURL_SSLVERSION_SSLv2: 
+                                       kTLSProtocol1,
+                                       true);
+    break;
+  case CURL_SSLVERSION_TLSv1_1:
+    failf(data, "Your version of the OS does not support TLSv1.1");
+    return CURLE_SSL_CONNECT_ERROR;
+  case CURL_SSLVERSION_TLSv1_2:
+    failf(data, "Your version of the OS does not support TLSv1.2");
+    return CURLE_SSL_CONNECT_ERROR;
+  case CURL_SSLVERSION_TLSv1_3:
+    failf(data, "Your version of the OS does not support TLSv1.3");
+    return CURLE_SSL_CONNECT_ERROR;
+  case CURL_SSLVERSION_SSLv2:
     err = SSLSetProtocolVersionEnabled(backend->ssl_ctx,
-                                       kSSLProtocol2, 
-                                       true); 
-    if(err != noErr) { 
-      failf(data, "Your version of the OS does not support SSLv2"); 
-      return CURLE_SSL_CONNECT_ERROR; 
-    } 
-    break; 
-  case CURL_SSLVERSION_SSLv3: 
+                                       kSSLProtocol2,
+                                       true);
+    if(err != noErr) {
+      failf(data, "Your version of the OS does not support SSLv2");
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+    break;
+  case CURL_SSLVERSION_SSLv3:
     err = SSLSetProtocolVersionEnabled(backend->ssl_ctx,
-                                       kSSLProtocol3, 
-                                       true); 
-    if(err != noErr) { 
-      failf(data, "Your version of the OS does not support SSLv3"); 
-      return CURLE_SSL_CONNECT_ERROR; 
-    } 
-    break; 
-  default: 
-    failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION"); 
-    return CURLE_SSL_CONNECT_ERROR; 
-  } 
-#endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */ 
- 
-#if (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) && HAVE_BUILTIN_AVAILABLE == 1 
-  if(conn->bits.tls_enable_alpn) { 
-    if(__builtin_available(macOS 10.13.4, iOS 11, tvOS 11, *)) { 
-      CFMutableArrayRef alpnArr = CFArrayCreateMutable(NULL, 0, 
-                                                       &kCFTypeArrayCallBacks); 
- 
-#ifdef USE_NGHTTP2 
+                                       kSSLProtocol3,
+                                       true);
+    if(err != noErr) {
+      failf(data, "Your version of the OS does not support SSLv3");
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+    break;
+  default:
+    failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION");
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+#endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */
+
+#if (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) && HAVE_BUILTIN_AVAILABLE == 1
+  if(conn->bits.tls_enable_alpn) {
+    if(__builtin_available(macOS 10.13.4, iOS 11, tvOS 11, *)) {
+      CFMutableArrayRef alpnArr = CFArrayCreateMutable(NULL, 0,
+                                                       &kCFTypeArrayCallBacks);
+
+#ifdef USE_NGHTTP2
       if(data->set.httpversion >= CURL_HTTP_VERSION_2
 #ifndef CURL_DISABLE_PROXY
          && (!SSL_IS_PROXY() || !conn->bits.tunnel_proxy)
 #endif
         ) {
-        CFArrayAppendValue(alpnArr, CFSTR(NGHTTP2_PROTO_VERSION_ID)); 
-        infof(data, "ALPN, offering %s\n", NGHTTP2_PROTO_VERSION_ID); 
-      } 
-#endif 
- 
-      CFArrayAppendValue(alpnArr, CFSTR(ALPN_HTTP_1_1)); 
-      infof(data, "ALPN, offering %s\n", ALPN_HTTP_1_1); 
- 
-      /* expects length prefixed preference ordered list of protocols in wire 
-       * format 
-       */ 
+        CFArrayAppendValue(alpnArr, CFSTR(NGHTTP2_PROTO_VERSION_ID));
+        infof(data, "ALPN, offering %s\n", NGHTTP2_PROTO_VERSION_ID);
+      }
+#endif
+
+      CFArrayAppendValue(alpnArr, CFSTR(ALPN_HTTP_1_1));
+      infof(data, "ALPN, offering %s\n", ALPN_HTTP_1_1);
+
+      /* expects length prefixed preference ordered list of protocols in wire
+       * format
+       */
       err = SSLSetALPNProtocols(backend->ssl_ctx, alpnArr);
-      if(err != noErr) 
-        infof(data, "WARNING: failed to set ALPN protocols; OSStatus %d\n", 
-              err); 
-      CFRelease(alpnArr); 
-    } 
-  } 
-#endif 
- 
-  if(SSL_SET_OPTION(key)) { 
-    infof(data, "WARNING: SSL: CURLOPT_SSLKEY is ignored by Secure " 
-          "Transport. The private key must be in the Keychain.\n"); 
-  } 
- 
+      if(err != noErr)
+        infof(data, "WARNING: failed to set ALPN protocols; OSStatus %d\n",
+              err);
+      CFRelease(alpnArr);
+    }
+  }
+#endif
+
+  if(SSL_SET_OPTION(key)) {
+    infof(data, "WARNING: SSL: CURLOPT_SSLKEY is ignored by Secure "
+          "Transport. The private key must be in the Keychain.\n");
+  }
+
   if(ssl_cert || ssl_cert_blob) {
     bool is_cert_data = ssl_cert_blob != NULL;
     bool is_cert_file = (!is_cert_data) && is_file(ssl_cert);
-    SecIdentityRef cert_and_key = NULL; 
- 
-    /* User wants to authenticate with a client cert. Look for it: 
-       If we detect that this is a file on disk, then let's load it. 
-       Otherwise, assume that the user wants to use an identity loaded 
-       from the Keychain. */ 
+    SecIdentityRef cert_and_key = NULL;
+
+    /* User wants to authenticate with a client cert. Look for it:
+       If we detect that this is a file on disk, then let's load it.
+       Otherwise, assume that the user wants to use an identity loaded
+       from the Keychain. */
     if(is_cert_file || is_cert_data) {
-      if(!SSL_SET_OPTION(cert_type)) 
-        infof(data, "WARNING: SSL: Certificate type not set, assuming " 
-                    "PKCS#12 format.\n"); 
-      else if(strncmp(SSL_SET_OPTION(cert_type), "P12", 
-        strlen(SSL_SET_OPTION(cert_type))) != 0) 
-        infof(data, "WARNING: SSL: The Security framework only supports " 
-                    "loading identities that are in PKCS#12 format.\n"); 
- 
+      if(!SSL_SET_OPTION(cert_type))
+        infof(data, "WARNING: SSL: Certificate type not set, assuming "
+                    "PKCS#12 format.\n");
+      else if(strncmp(SSL_SET_OPTION(cert_type), "P12",
+        strlen(SSL_SET_OPTION(cert_type))) != 0)
+        infof(data, "WARNING: SSL: The Security framework only supports "
+                    "loading identities that are in PKCS#12 format.\n");
+
       err = CopyIdentityFromPKCS12File(ssl_cert, ssl_cert_blob,
-        SSL_SET_OPTION(key_passwd), &cert_and_key); 
-    } 
-    else 
-      err = CopyIdentityWithLabel(ssl_cert, &cert_and_key); 
- 
-    if(err == noErr && cert_and_key) { 
-      SecCertificateRef cert = NULL; 
-      CFTypeRef certs_c[1]; 
-      CFArrayRef certs; 
- 
-      /* If we found one, print it out: */ 
-      err = SecIdentityCopyCertificate(cert_and_key, &cert); 
-      if(err == noErr) { 
-        char *certp; 
-        CURLcode result = CopyCertSubject(data, cert, &certp); 
-        if(!result) { 
-          infof(data, "Client certificate: %s\n", certp); 
-          free(certp); 
-        } 
- 
-        CFRelease(cert); 
-        if(result == CURLE_PEER_FAILED_VERIFICATION) 
-          return CURLE_SSL_CERTPROBLEM; 
-        if(result) 
-          return result; 
-      } 
-      certs_c[0] = cert_and_key; 
-      certs = CFArrayCreate(NULL, (const void **)certs_c, 1L, 
-                            &kCFTypeArrayCallBacks); 
+        SSL_SET_OPTION(key_passwd), &cert_and_key);
+    }
+    else
+      err = CopyIdentityWithLabel(ssl_cert, &cert_and_key);
+
+    if(err == noErr && cert_and_key) {
+      SecCertificateRef cert = NULL;
+      CFTypeRef certs_c[1];
+      CFArrayRef certs;
+
+      /* If we found one, print it out: */
+      err = SecIdentityCopyCertificate(cert_and_key, &cert);
+      if(err == noErr) {
+        char *certp;
+        CURLcode result = CopyCertSubject(data, cert, &certp);
+        if(!result) {
+          infof(data, "Client certificate: %s\n", certp);
+          free(certp);
+        }
+
+        CFRelease(cert);
+        if(result == CURLE_PEER_FAILED_VERIFICATION)
+          return CURLE_SSL_CERTPROBLEM;
+        if(result)
+          return result;
+      }
+      certs_c[0] = cert_and_key;
+      certs = CFArrayCreate(NULL, (const void **)certs_c, 1L,
+                            &kCFTypeArrayCallBacks);
       err = SSLSetCertificate(backend->ssl_ctx, certs);
-      if(certs) 
-        CFRelease(certs); 
-      if(err != noErr) { 
-        failf(data, "SSL: SSLSetCertificate() failed: OSStatus %d", err); 
-        return CURLE_SSL_CERTPROBLEM; 
-      } 
-      CFRelease(cert_and_key); 
-    } 
-    else { 
+      if(certs)
+        CFRelease(certs);
+      if(err != noErr) {
+        failf(data, "SSL: SSLSetCertificate() failed: OSStatus %d", err);
+        return CURLE_SSL_CERTPROBLEM;
+      }
+      CFRelease(cert_and_key);
+    }
+    else {
       const char *cert_showfilename_error =
         is_cert_data ? "(memory blob)" : ssl_cert;
 
-      switch(err) { 
-      case errSecAuthFailed: case -25264: /* errSecPkcs12VerifyFailure */ 
-        failf(data, "SSL: Incorrect password for the certificate \"%s\" " 
+      switch(err) {
+      case errSecAuthFailed: case -25264: /* errSecPkcs12VerifyFailure */
+        failf(data, "SSL: Incorrect password for the certificate \"%s\" "
                     "and its private key.", cert_showfilename_error);
-        break; 
-      case -26275: /* errSecDecode */ case -25257: /* errSecUnknownFormat */ 
-        failf(data, "SSL: Couldn't make sense of the data in the " 
-                    "certificate \"%s\" and its private key.", 
+        break;
+      case -26275: /* errSecDecode */ case -25257: /* errSecUnknownFormat */
+        failf(data, "SSL: Couldn't make sense of the data in the "
+                    "certificate \"%s\" and its private key.",
                     cert_showfilename_error);
-        break; 
-      case -25260: /* errSecPassphraseRequired */ 
-        failf(data, "SSL The certificate \"%s\" requires a password.", 
+        break;
+      case -25260: /* errSecPassphraseRequired */
+        failf(data, "SSL The certificate \"%s\" requires a password.",
                     cert_showfilename_error);
-        break; 
-      case errSecItemNotFound: 
-        failf(data, "SSL: Can't find the certificate \"%s\" and its private " 
+        break;
+      case errSecItemNotFound:
+        failf(data, "SSL: Can't find the certificate \"%s\" and its private "
                     "key in the Keychain.", cert_showfilename_error);
-        break; 
-      default: 
-        failf(data, "SSL: Can't load the certificate \"%s\" and its private " 
+        break;
+      default:
+        failf(data, "SSL: Can't load the certificate \"%s\" and its private "
                     "key: OSStatus %d", cert_showfilename_error, err);
-        break; 
-      } 
-      return CURLE_SSL_CERTPROBLEM; 
-    } 
-  } 
- 
-  /* SSL always tries to verify the peer, this only says whether it should 
-   * fail to connect if the verification fails, or if it should continue 
-   * anyway. In the latter case the result of the verification is checked with 
-   * SSL_get_verify_result() below. */ 
-#if CURL_BUILD_MAC_10_6 || CURL_BUILD_IOS 
-  /* Snow Leopard introduced the SSLSetSessionOption() function, but due to 
-     a library bug with the way the kSSLSessionOptionBreakOnServerAuth flag 
-     works, it doesn't work as expected under Snow Leopard, Lion or 
-     Mountain Lion. 
-     So we need to call SSLSetEnableCertVerify() on those older cats in order 
-     to disable certificate validation if the user turned that off. 
-     (SecureTransport will always validate the certificate chain by 
-     default.) 
-  Note: 
-  Darwin 11.x.x is Lion (10.7) 
-  Darwin 12.x.x is Mountain Lion (10.8) 
-  Darwin 13.x.x is Mavericks (10.9) 
-  Darwin 14.x.x is Yosemite (10.10) 
-  Darwin 15.x.x is El Capitan (10.11) 
-  */ 
-#if CURL_BUILD_MAC 
-  if(SSLSetSessionOption != NULL && darwinver_maj >= 13) { 
-#else 
-  if(SSLSetSessionOption != NULL) { 
-#endif /* CURL_BUILD_MAC */ 
+        break;
+      }
+      return CURLE_SSL_CERTPROBLEM;
+    }
+  }
+
+  /* SSL always tries to verify the peer, this only says whether it should
+   * fail to connect if the verification fails, or if it should continue
+   * anyway. In the latter case the result of the verification is checked with
+   * SSL_get_verify_result() below. */
+#if CURL_BUILD_MAC_10_6 || CURL_BUILD_IOS
+  /* Snow Leopard introduced the SSLSetSessionOption() function, but due to
+     a library bug with the way the kSSLSessionOptionBreakOnServerAuth flag
+     works, it doesn't work as expected under Snow Leopard, Lion or
+     Mountain Lion.
+     So we need to call SSLSetEnableCertVerify() on those older cats in order
+     to disable certificate validation if the user turned that off.
+     (SecureTransport will always validate the certificate chain by
+     default.)
+  Note:
+  Darwin 11.x.x is Lion (10.7)
+  Darwin 12.x.x is Mountain Lion (10.8)
+  Darwin 13.x.x is Mavericks (10.9)
+  Darwin 14.x.x is Yosemite (10.10)
+  Darwin 15.x.x is El Capitan (10.11)
+  */
+#if CURL_BUILD_MAC
+  if(SSLSetSessionOption != NULL && darwinver_maj >= 13) {
+#else
+  if(SSLSetSessionOption != NULL) {
+#endif /* CURL_BUILD_MAC */
     bool break_on_auth = !conn->ssl_config.verifypeer ||
       ssl_cafile || ssl_cablob;
     err = SSLSetSessionOption(backend->ssl_ctx,
-                              kSSLSessionOptionBreakOnServerAuth, 
-                              break_on_auth); 
-    if(err != noErr) { 
-      failf(data, "SSL: SSLSetSessionOption() failed: OSStatus %d", err); 
-      return CURLE_SSL_CONNECT_ERROR; 
-    } 
-  } 
-  else { 
-#if CURL_SUPPORT_MAC_10_8 
+                              kSSLSessionOptionBreakOnServerAuth,
+                              break_on_auth);
+    if(err != noErr) {
+      failf(data, "SSL: SSLSetSessionOption() failed: OSStatus %d", err);
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+  }
+  else {
+#if CURL_SUPPORT_MAC_10_8
     err = SSLSetEnableCertVerify(backend->ssl_ctx,
-                                 conn->ssl_config.verifypeer?true:false); 
-    if(err != noErr) { 
-      failf(data, "SSL: SSLSetEnableCertVerify() failed: OSStatus %d", err); 
-      return CURLE_SSL_CONNECT_ERROR; 
-    } 
-#endif /* CURL_SUPPORT_MAC_10_8 */ 
-  } 
-#else 
+                                 conn->ssl_config.verifypeer?true:false);
+    if(err != noErr) {
+      failf(data, "SSL: SSLSetEnableCertVerify() failed: OSStatus %d", err);
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+#endif /* CURL_SUPPORT_MAC_10_8 */
+  }
+#else
   err = SSLSetEnableCertVerify(backend->ssl_ctx,
-                               conn->ssl_config.verifypeer?true:false); 
-  if(err != noErr) { 
-    failf(data, "SSL: SSLSetEnableCertVerify() failed: OSStatus %d", err); 
-    return CURLE_SSL_CONNECT_ERROR; 
-  } 
-#endif /* CURL_BUILD_MAC_10_6 || CURL_BUILD_IOS */ 
- 
+                               conn->ssl_config.verifypeer?true:false);
+  if(err != noErr) {
+    failf(data, "SSL: SSLSetEnableCertVerify() failed: OSStatus %d", err);
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+#endif /* CURL_BUILD_MAC_10_6 || CURL_BUILD_IOS */
+
   if((ssl_cafile || ssl_cablob) && verifypeer) {
     bool is_cert_data = ssl_cablob != NULL;
     bool is_cert_file = (!is_cert_data) && is_file(ssl_cafile);
- 
+
     if(!(is_cert_file || is_cert_data)) {
-      failf(data, "SSL: can't load CA certificate file %s", ssl_cafile); 
-      return CURLE_SSL_CACERT_BADFILE; 
-    } 
-  } 
- 
-  /* Configure hostname check. SNI is used if available. 
-   * Both hostname check and SNI require SSLSetPeerDomainName(). 
-   * Also: the verifyhost setting influences SNI usage */ 
-  if(conn->ssl_config.verifyhost) { 
+      failf(data, "SSL: can't load CA certificate file %s", ssl_cafile);
+      return CURLE_SSL_CACERT_BADFILE;
+    }
+  }
+
+  /* Configure hostname check. SNI is used if available.
+   * Both hostname check and SNI require SSLSetPeerDomainName().
+   * Also: the verifyhost setting influences SNI usage */
+  if(conn->ssl_config.verifyhost) {
     err = SSLSetPeerDomainName(backend->ssl_ctx, hostname,
-    strlen(hostname)); 
- 
-    if(err != noErr) { 
-      infof(data, "WARNING: SSL: SSLSetPeerDomainName() failed: OSStatus %d\n", 
-            err); 
-    } 
- 
-    if((Curl_inet_pton(AF_INET, hostname, &addr)) 
-  #ifdef ENABLE_IPV6 
-    || (Curl_inet_pton(AF_INET6, hostname, &addr)) 
-  #endif 
-       ) { 
-      infof(data, "WARNING: using IP address, SNI is being disabled by " 
-            "the OS.\n"); 
-    } 
-  } 
-  else { 
-    infof(data, "WARNING: disabling hostname validation also disables SNI.\n"); 
-  } 
- 
-  /* Disable cipher suites that ST supports but are not safe. These ciphers 
-     are unlikely to be used in any case since ST gives other ciphers a much 
-     higher priority, but it's probably better that we not connect at all than 
-     to give the user a false sense of security if the server only supports 
-     insecure ciphers. (Note: We don't care about SSLv2-only ciphers.) */ 
+    strlen(hostname));
+
+    if(err != noErr) {
+      infof(data, "WARNING: SSL: SSLSetPeerDomainName() failed: OSStatus %d\n",
+            err);
+    }
+
+    if((Curl_inet_pton(AF_INET, hostname, &addr))
+  #ifdef ENABLE_IPV6
+    || (Curl_inet_pton(AF_INET6, hostname, &addr))
+  #endif
+       ) {
+      infof(data, "WARNING: using IP address, SNI is being disabled by "
+            "the OS.\n");
+    }
+  }
+  else {
+    infof(data, "WARNING: disabling hostname validation also disables SNI.\n");
+  }
+
+  /* Disable cipher suites that ST supports but are not safe. These ciphers
+     are unlikely to be used in any case since ST gives other ciphers a much
+     higher priority, but it's probably better that we not connect at all than
+     to give the user a false sense of security if the server only supports
+     insecure ciphers. (Note: We don't care about SSLv2-only ciphers.) */
   err = SSLGetNumberSupportedCiphers(backend->ssl_ctx, &all_ciphers_count);
-  if(err != noErr) { 
-    failf(data, "SSL: SSLGetNumberSupportedCiphers() failed: OSStatus %d", 
-          err); 
-    return CURLE_SSL_CIPHER; 
-  } 
-  all_ciphers = malloc(all_ciphers_count*sizeof(SSLCipherSuite)); 
-  if(!all_ciphers) { 
-    failf(data, "SSL: Failed to allocate memory for all ciphers"); 
-    return CURLE_OUT_OF_MEMORY; 
-  } 
-  allowed_ciphers = malloc(all_ciphers_count*sizeof(SSLCipherSuite)); 
-  if(!allowed_ciphers) { 
-    Curl_safefree(all_ciphers); 
-    failf(data, "SSL: Failed to allocate memory for allowed ciphers"); 
-    return CURLE_OUT_OF_MEMORY; 
-  } 
+  if(err != noErr) {
+    failf(data, "SSL: SSLGetNumberSupportedCiphers() failed: OSStatus %d",
+          err);
+    return CURLE_SSL_CIPHER;
+  }
+  all_ciphers = malloc(all_ciphers_count*sizeof(SSLCipherSuite));
+  if(!all_ciphers) {
+    failf(data, "SSL: Failed to allocate memory for all ciphers");
+    return CURLE_OUT_OF_MEMORY;
+  }
+  allowed_ciphers = malloc(all_ciphers_count*sizeof(SSLCipherSuite));
+  if(!allowed_ciphers) {
+    Curl_safefree(all_ciphers);
+    failf(data, "SSL: Failed to allocate memory for allowed ciphers");
+    return CURLE_OUT_OF_MEMORY;
+  }
   err = SSLGetSupportedCiphers(backend->ssl_ctx, all_ciphers,
-                               &all_ciphers_count); 
-  if(err != noErr) { 
-    Curl_safefree(all_ciphers); 
-    Curl_safefree(allowed_ciphers); 
-    return CURLE_SSL_CIPHER; 
-  } 
-  for(i = 0UL ; i < all_ciphers_count ; i++) { 
-#if CURL_BUILD_MAC 
-   /* There's a known bug in early versions of Mountain Lion where ST's ECC 
-      ciphers (cipher suite 0xC001 through 0xC032) simply do not work. 
-      Work around the problem here by disabling those ciphers if we are 
-      running in an affected version of OS X. */ 
-    if(darwinver_maj == 12 && darwinver_min <= 3 && 
-       all_ciphers[i] >= 0xC001 && all_ciphers[i] <= 0xC032) { 
-      continue; 
-    } 
-#endif /* CURL_BUILD_MAC */ 
-    switch(all_ciphers[i]) { 
-      /* Disable NULL ciphersuites: */ 
-      case SSL_NULL_WITH_NULL_NULL: 
-      case SSL_RSA_WITH_NULL_MD5: 
-      case SSL_RSA_WITH_NULL_SHA: 
-      case 0x003B: /* TLS_RSA_WITH_NULL_SHA256 */ 
-      case SSL_FORTEZZA_DMS_WITH_NULL_SHA: 
-      case 0xC001: /* TLS_ECDH_ECDSA_WITH_NULL_SHA */ 
-      case 0xC006: /* TLS_ECDHE_ECDSA_WITH_NULL_SHA */ 
-      case 0xC00B: /* TLS_ECDH_RSA_WITH_NULL_SHA */ 
-      case 0xC010: /* TLS_ECDHE_RSA_WITH_NULL_SHA */ 
-      case 0x002C: /* TLS_PSK_WITH_NULL_SHA */ 
-      case 0x002D: /* TLS_DHE_PSK_WITH_NULL_SHA */ 
-      case 0x002E: /* TLS_RSA_PSK_WITH_NULL_SHA */ 
-      case 0x00B0: /* TLS_PSK_WITH_NULL_SHA256 */ 
-      case 0x00B1: /* TLS_PSK_WITH_NULL_SHA384 */ 
-      case 0x00B4: /* TLS_DHE_PSK_WITH_NULL_SHA256 */ 
-      case 0x00B5: /* TLS_DHE_PSK_WITH_NULL_SHA384 */ 
-      case 0x00B8: /* TLS_RSA_PSK_WITH_NULL_SHA256 */ 
-      case 0x00B9: /* TLS_RSA_PSK_WITH_NULL_SHA384 */ 
-      /* Disable anonymous ciphersuites: */ 
-      case SSL_DH_anon_EXPORT_WITH_RC4_40_MD5: 
-      case SSL_DH_anon_WITH_RC4_128_MD5: 
-      case SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA: 
-      case SSL_DH_anon_WITH_DES_CBC_SHA: 
-      case SSL_DH_anon_WITH_3DES_EDE_CBC_SHA: 
-      case TLS_DH_anon_WITH_AES_128_CBC_SHA: 
-      case TLS_DH_anon_WITH_AES_256_CBC_SHA: 
-      case 0xC015: /* TLS_ECDH_anon_WITH_NULL_SHA */ 
-      case 0xC016: /* TLS_ECDH_anon_WITH_RC4_128_SHA */ 
-      case 0xC017: /* TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA */ 
-      case 0xC018: /* TLS_ECDH_anon_WITH_AES_128_CBC_SHA */ 
-      case 0xC019: /* TLS_ECDH_anon_WITH_AES_256_CBC_SHA */ 
-      case 0x006C: /* TLS_DH_anon_WITH_AES_128_CBC_SHA256 */ 
-      case 0x006D: /* TLS_DH_anon_WITH_AES_256_CBC_SHA256 */ 
-      case 0x00A6: /* TLS_DH_anon_WITH_AES_128_GCM_SHA256 */ 
-      case 0x00A7: /* TLS_DH_anon_WITH_AES_256_GCM_SHA384 */ 
-      /* Disable weak key ciphersuites: */ 
-      case SSL_RSA_EXPORT_WITH_RC4_40_MD5: 
-      case SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5: 
-      case SSL_RSA_EXPORT_WITH_DES40_CBC_SHA: 
-      case SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA: 
-      case SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA: 
-      case SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA: 
-      case SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA: 
-      case SSL_RSA_WITH_DES_CBC_SHA: 
-      case SSL_DH_DSS_WITH_DES_CBC_SHA: 
-      case SSL_DH_RSA_WITH_DES_CBC_SHA: 
-      case SSL_DHE_DSS_WITH_DES_CBC_SHA: 
-      case SSL_DHE_RSA_WITH_DES_CBC_SHA: 
-      /* Disable IDEA: */ 
-      case SSL_RSA_WITH_IDEA_CBC_SHA: 
-      case SSL_RSA_WITH_IDEA_CBC_MD5: 
-      /* Disable RC4: */ 
-      case SSL_RSA_WITH_RC4_128_MD5: 
-      case SSL_RSA_WITH_RC4_128_SHA: 
-      case 0xC002: /* TLS_ECDH_ECDSA_WITH_RC4_128_SHA */ 
-      case 0xC007: /* TLS_ECDHE_ECDSA_WITH_RC4_128_SHA*/ 
-      case 0xC00C: /* TLS_ECDH_RSA_WITH_RC4_128_SHA */ 
-      case 0xC011: /* TLS_ECDHE_RSA_WITH_RC4_128_SHA */ 
-      case 0x008A: /* TLS_PSK_WITH_RC4_128_SHA */ 
-      case 0x008E: /* TLS_DHE_PSK_WITH_RC4_128_SHA */ 
-      case 0x0092: /* TLS_RSA_PSK_WITH_RC4_128_SHA */ 
-        break; 
-      default: /* enable everything else */ 
-        allowed_ciphers[allowed_ciphers_count++] = all_ciphers[i]; 
-        break; 
-    } 
-  } 
+                               &all_ciphers_count);
+  if(err != noErr) {
+    Curl_safefree(all_ciphers);
+    Curl_safefree(allowed_ciphers);
+    return CURLE_SSL_CIPHER;
+  }
+  for(i = 0UL ; i < all_ciphers_count ; i++) {
+#if CURL_BUILD_MAC
+   /* There's a known bug in early versions of Mountain Lion where ST's ECC
+      ciphers (cipher suite 0xC001 through 0xC032) simply do not work.
+      Work around the problem here by disabling those ciphers if we are
+      running in an affected version of OS X. */
+    if(darwinver_maj == 12 && darwinver_min <= 3 &&
+       all_ciphers[i] >= 0xC001 && all_ciphers[i] <= 0xC032) {
+      continue;
+    }
+#endif /* CURL_BUILD_MAC */
+    switch(all_ciphers[i]) {
+      /* Disable NULL ciphersuites: */
+      case SSL_NULL_WITH_NULL_NULL:
+      case SSL_RSA_WITH_NULL_MD5:
+      case SSL_RSA_WITH_NULL_SHA:
+      case 0x003B: /* TLS_RSA_WITH_NULL_SHA256 */
+      case SSL_FORTEZZA_DMS_WITH_NULL_SHA:
+      case 0xC001: /* TLS_ECDH_ECDSA_WITH_NULL_SHA */
+      case 0xC006: /* TLS_ECDHE_ECDSA_WITH_NULL_SHA */
+      case 0xC00B: /* TLS_ECDH_RSA_WITH_NULL_SHA */
+      case 0xC010: /* TLS_ECDHE_RSA_WITH_NULL_SHA */
+      case 0x002C: /* TLS_PSK_WITH_NULL_SHA */
+      case 0x002D: /* TLS_DHE_PSK_WITH_NULL_SHA */
+      case 0x002E: /* TLS_RSA_PSK_WITH_NULL_SHA */
+      case 0x00B0: /* TLS_PSK_WITH_NULL_SHA256 */
+      case 0x00B1: /* TLS_PSK_WITH_NULL_SHA384 */
+      case 0x00B4: /* TLS_DHE_PSK_WITH_NULL_SHA256 */
+      case 0x00B5: /* TLS_DHE_PSK_WITH_NULL_SHA384 */
+      case 0x00B8: /* TLS_RSA_PSK_WITH_NULL_SHA256 */
+      case 0x00B9: /* TLS_RSA_PSK_WITH_NULL_SHA384 */
+      /* Disable anonymous ciphersuites: */
+      case SSL_DH_anon_EXPORT_WITH_RC4_40_MD5:
+      case SSL_DH_anon_WITH_RC4_128_MD5:
+      case SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA:
+      case SSL_DH_anon_WITH_DES_CBC_SHA:
+      case SSL_DH_anon_WITH_3DES_EDE_CBC_SHA:
+      case TLS_DH_anon_WITH_AES_128_CBC_SHA:
+      case TLS_DH_anon_WITH_AES_256_CBC_SHA:
+      case 0xC015: /* TLS_ECDH_anon_WITH_NULL_SHA */
+      case 0xC016: /* TLS_ECDH_anon_WITH_RC4_128_SHA */
+      case 0xC017: /* TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA */
+      case 0xC018: /* TLS_ECDH_anon_WITH_AES_128_CBC_SHA */
+      case 0xC019: /* TLS_ECDH_anon_WITH_AES_256_CBC_SHA */
+      case 0x006C: /* TLS_DH_anon_WITH_AES_128_CBC_SHA256 */
+      case 0x006D: /* TLS_DH_anon_WITH_AES_256_CBC_SHA256 */
+      case 0x00A6: /* TLS_DH_anon_WITH_AES_128_GCM_SHA256 */
+      case 0x00A7: /* TLS_DH_anon_WITH_AES_256_GCM_SHA384 */
+      /* Disable weak key ciphersuites: */
+      case SSL_RSA_EXPORT_WITH_RC4_40_MD5:
+      case SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5:
+      case SSL_RSA_EXPORT_WITH_DES40_CBC_SHA:
+      case SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA:
+      case SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA:
+      case SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA:
+      case SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA:
+      case SSL_RSA_WITH_DES_CBC_SHA:
+      case SSL_DH_DSS_WITH_DES_CBC_SHA:
+      case SSL_DH_RSA_WITH_DES_CBC_SHA:
+      case SSL_DHE_DSS_WITH_DES_CBC_SHA:
+      case SSL_DHE_RSA_WITH_DES_CBC_SHA:
+      /* Disable IDEA: */
+      case SSL_RSA_WITH_IDEA_CBC_SHA:
+      case SSL_RSA_WITH_IDEA_CBC_MD5:
+      /* Disable RC4: */
+      case SSL_RSA_WITH_RC4_128_MD5:
+      case SSL_RSA_WITH_RC4_128_SHA:
+      case 0xC002: /* TLS_ECDH_ECDSA_WITH_RC4_128_SHA */
+      case 0xC007: /* TLS_ECDHE_ECDSA_WITH_RC4_128_SHA*/
+      case 0xC00C: /* TLS_ECDH_RSA_WITH_RC4_128_SHA */
+      case 0xC011: /* TLS_ECDHE_RSA_WITH_RC4_128_SHA */
+      case 0x008A: /* TLS_PSK_WITH_RC4_128_SHA */
+      case 0x008E: /* TLS_DHE_PSK_WITH_RC4_128_SHA */
+      case 0x0092: /* TLS_RSA_PSK_WITH_RC4_128_SHA */
+        break;
+      default: /* enable everything else */
+        allowed_ciphers[allowed_ciphers_count++] = all_ciphers[i];
+        break;
+    }
+  }
   err = SSLSetEnabledCiphers(backend->ssl_ctx, allowed_ciphers,
-                             allowed_ciphers_count); 
-  Curl_safefree(all_ciphers); 
-  Curl_safefree(allowed_ciphers); 
-  if(err != noErr) { 
-    failf(data, "SSL: SSLSetEnabledCiphers() failed: OSStatus %d", err); 
-    return CURLE_SSL_CIPHER; 
-  } 
- 
-#if CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7 
-  /* We want to enable 1/n-1 when using a CBC cipher unless the user 
-     specifically doesn't want us doing that: */ 
-  if(SSLSetSessionOption != NULL) { 
+                             allowed_ciphers_count);
+  Curl_safefree(all_ciphers);
+  Curl_safefree(allowed_ciphers);
+  if(err != noErr) {
+    failf(data, "SSL: SSLSetEnabledCiphers() failed: OSStatus %d", err);
+    return CURLE_SSL_CIPHER;
+  }
+
+#if CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7
+  /* We want to enable 1/n-1 when using a CBC cipher unless the user
+     specifically doesn't want us doing that: */
+  if(SSLSetSessionOption != NULL) {
     SSLSetSessionOption(backend->ssl_ctx, kSSLSessionOptionSendOneByteRecord,
-                      !data->set.ssl.enable_beast); 
+                      !data->set.ssl.enable_beast);
     SSLSetSessionOption(backend->ssl_ctx, kSSLSessionOptionFalseStart,
-                      data->set.ssl.falsestart); /* false start support */ 
-  } 
-#endif /* CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7 */ 
- 
-  /* Check if there's a cached ID we can/should use here! */ 
-  if(SSL_SET_OPTION(primary.sessionid)) { 
-    char *ssl_sessionid; 
-    size_t ssl_sessionid_len; 
- 
-    Curl_ssl_sessionid_lock(conn); 
-    if(!Curl_ssl_getsessionid(conn, (void **)&ssl_sessionid, 
-                              &ssl_sessionid_len, sockindex)) { 
-      /* we got a session id, use it! */ 
+                      data->set.ssl.falsestart); /* false start support */
+  }
+#endif /* CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7 */
+
+  /* Check if there's a cached ID we can/should use here! */
+  if(SSL_SET_OPTION(primary.sessionid)) {
+    char *ssl_sessionid;
+    size_t ssl_sessionid_len;
+
+    Curl_ssl_sessionid_lock(conn);
+    if(!Curl_ssl_getsessionid(conn, (void **)&ssl_sessionid,
+                              &ssl_sessionid_len, sockindex)) {
+      /* we got a session id, use it! */
       err = SSLSetPeerID(backend->ssl_ctx, ssl_sessionid, ssl_sessionid_len);
-      Curl_ssl_sessionid_unlock(conn); 
-      if(err != noErr) { 
-        failf(data, "SSL: SSLSetPeerID() failed: OSStatus %d", err); 
-        return CURLE_SSL_CONNECT_ERROR; 
-      } 
-      /* Informational message */ 
-      infof(data, "SSL re-using session ID\n"); 
-    } 
-    /* If there isn't one, then let's make one up! This has to be done prior 
-       to starting the handshake. */ 
-    else { 
-      CURLcode result; 
-      ssl_sessionid = 
+      Curl_ssl_sessionid_unlock(conn);
+      if(err != noErr) {
+        failf(data, "SSL: SSLSetPeerID() failed: OSStatus %d", err);
+        return CURLE_SSL_CONNECT_ERROR;
+      }
+      /* Informational message */
+      infof(data, "SSL re-using session ID\n");
+    }
+    /* If there isn't one, then let's make one up! This has to be done prior
+       to starting the handshake. */
+    else {
+      CURLcode result;
+      ssl_sessionid =
         aprintf("%s:%d:%d:%s:%ld", ssl_cafile,
-                verifypeer, SSL_CONN_CONFIG(verifyhost), hostname, port); 
-      ssl_sessionid_len = strlen(ssl_sessionid); 
- 
+                verifypeer, SSL_CONN_CONFIG(verifyhost), hostname, port);
+      ssl_sessionid_len = strlen(ssl_sessionid);
+
       err = SSLSetPeerID(backend->ssl_ctx, ssl_sessionid, ssl_sessionid_len);
-      if(err != noErr) { 
-        Curl_ssl_sessionid_unlock(conn); 
-        failf(data, "SSL: SSLSetPeerID() failed: OSStatus %d", err); 
-        return CURLE_SSL_CONNECT_ERROR; 
-      } 
- 
-      result = Curl_ssl_addsessionid(conn, ssl_sessionid, ssl_sessionid_len, 
-                                     sockindex); 
-      Curl_ssl_sessionid_unlock(conn); 
-      if(result) { 
-        failf(data, "failed to store ssl session"); 
-        return result; 
-      } 
-    } 
-  } 
- 
+      if(err != noErr) {
+        Curl_ssl_sessionid_unlock(conn);
+        failf(data, "SSL: SSLSetPeerID() failed: OSStatus %d", err);
+        return CURLE_SSL_CONNECT_ERROR;
+      }
+
+      result = Curl_ssl_addsessionid(conn, ssl_sessionid, ssl_sessionid_len,
+                                     sockindex);
+      Curl_ssl_sessionid_unlock(conn);
+      if(result) {
+        failf(data, "failed to store ssl session");
+        return result;
+      }
+    }
+  }
+
   err = SSLSetIOFuncs(backend->ssl_ctx, SocketRead, SocketWrite);
-  if(err != noErr) { 
-    failf(data, "SSL: SSLSetIOFuncs() failed: OSStatus %d", err); 
-    return CURLE_SSL_CONNECT_ERROR; 
-  } 
- 
-  /* pass the raw socket into the SSL layers */ 
-  /* We need to store the FD in a constant memory address, because 
-   * SSLSetConnection() will not copy that address. I've found that 
-   * conn->sock[sockindex] may change on its own. */ 
+  if(err != noErr) {
+    failf(data, "SSL: SSLSetIOFuncs() failed: OSStatus %d", err);
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+
+  /* pass the raw socket into the SSL layers */
+  /* We need to store the FD in a constant memory address, because
+   * SSLSetConnection() will not copy that address. I've found that
+   * conn->sock[sockindex] may change on its own. */
   backend->ssl_sockfd = sockfd;
   err = SSLSetConnection(backend->ssl_ctx, connssl);
-  if(err != noErr) { 
-    failf(data, "SSL: SSLSetConnection() failed: %d", err); 
-    return CURLE_SSL_CONNECT_ERROR; 
-  } 
- 
-  connssl->connecting_state = ssl_connect_2; 
-  return CURLE_OK; 
-} 
- 
-static long pem_to_der(const char *in, unsigned char **out, size_t *outlen) 
-{ 
-  char *sep_start, *sep_end, *cert_start, *cert_end; 
-  size_t i, j, err; 
-  size_t len; 
-  unsigned char *b64; 
- 
-  /* Jump through the separators at the beginning of the certificate. */ 
-  sep_start = strstr(in, "-----"); 
-  if(sep_start == NULL) 
-    return 0; 
-  cert_start = strstr(sep_start + 1, "-----"); 
-  if(cert_start == NULL) 
-    return -1; 
- 
-  cert_start += 5; 
- 
-  /* Find separator after the end of the certificate. */ 
-  cert_end = strstr(cert_start, "-----"); 
-  if(cert_end == NULL) 
-    return -1; 
- 
-  sep_end = strstr(cert_end + 1, "-----"); 
-  if(sep_end == NULL) 
-    return -1; 
-  sep_end += 5; 
- 
-  len = cert_end - cert_start; 
-  b64 = malloc(len + 1); 
-  if(!b64) 
-    return -1; 
- 
-  /* Create base64 string without linefeeds. */ 
-  for(i = 0, j = 0; i < len; i++) { 
-    if(cert_start[i] != '\r' && cert_start[i] != '\n') 
-      b64[j++] = cert_start[i]; 
-  } 
-  b64[j] = '\0'; 
- 
-  err = Curl_base64_decode((const char *)b64, out, outlen); 
-  free(b64); 
-  if(err) { 
-    free(*out); 
-    return -1; 
-  } 
- 
-  return sep_end - in; 
-} 
- 
-static int read_cert(const char *file, unsigned char **out, size_t *outlen) 
-{ 
-  int fd; 
-  ssize_t n, len = 0, cap = 512; 
-  unsigned char buf[512], *data; 
- 
-  fd = open(file, 0); 
-  if(fd < 0) 
-    return -1; 
- 
-  data = malloc(cap); 
-  if(!data) { 
-    close(fd); 
-    return -1; 
-  } 
- 
-  for(;;) { 
-    n = read(fd, buf, sizeof(buf)); 
-    if(n < 0) { 
-      close(fd); 
-      free(data); 
-      return -1; 
-    } 
-    else if(n == 0) { 
-      close(fd); 
-      break; 
-    } 
- 
-    if(len + n >= cap) { 
-      cap *= 2; 
-      data = Curl_saferealloc(data, cap); 
-      if(!data) { 
-        close(fd); 
-        return -1; 
-      } 
-    } 
- 
-    memcpy(data + len, buf, n); 
-    len += n; 
-  } 
-  data[len] = '\0'; 
- 
-  *out = data; 
-  *outlen = len; 
- 
-  return 0; 
-} 
- 
-static int append_cert_to_array(struct Curl_easy *data, 
-                                unsigned char *buf, size_t buflen, 
-                                CFMutableArrayRef array) 
-{ 
-    CFDataRef certdata = CFDataCreate(kCFAllocatorDefault, buf, buflen); 
-    char *certp; 
-    CURLcode result; 
-    if(!certdata) { 
-      failf(data, "SSL: failed to allocate array for CA certificate"); 
-      return CURLE_OUT_OF_MEMORY; 
-    } 
- 
-    SecCertificateRef cacert = 
-      SecCertificateCreateWithData(kCFAllocatorDefault, certdata); 
-    CFRelease(certdata); 
-    if(!cacert) { 
-      failf(data, "SSL: failed to create SecCertificate from CA certificate"); 
-      return CURLE_SSL_CACERT_BADFILE; 
-    } 
- 
-    /* Check if cacert is valid. */ 
-    result = CopyCertSubject(data, cacert, &certp); 
-    switch(result) { 
-      case CURLE_OK: 
-        break; 
-      case CURLE_PEER_FAILED_VERIFICATION: 
-        return CURLE_SSL_CACERT_BADFILE; 
-      case CURLE_OUT_OF_MEMORY: 
-      default: 
-        return result; 
-    } 
-    free(certp); 
- 
-    CFArrayAppendValue(array, cacert); 
-    CFRelease(cacert); 
- 
-    return CURLE_OK; 
-} 
- 
-static CURLcode verify_cert(const char *cafile, struct Curl_easy *data, 
-                            SSLContextRef ctx) 
-{ 
-  int n = 0, rc; 
-  long res; 
-  unsigned char *certbuf, *der; 
-  size_t buflen, derlen, offset = 0; 
- 
-  if(read_cert(cafile, &certbuf, &buflen) < 0) { 
-    failf(data, "SSL: failed to read or invalid CA certificate"); 
-    return CURLE_SSL_CACERT_BADFILE; 
-  } 
- 
-  /* 
-   * Certbuf now contains the contents of the certificate file, which can be 
-   * - a single DER certificate, 
-   * - a single PEM certificate or 
-   * - a bunch of PEM certificates (certificate bundle). 
-   * 
-   * Go through certbuf, and convert any PEM certificate in it into DER 
-   * format. 
-   */ 
-  CFMutableArrayRef array = CFArrayCreateMutable(kCFAllocatorDefault, 0, 
-                                                 &kCFTypeArrayCallBacks); 
-  if(array == NULL) { 
-    free(certbuf); 
-    failf(data, "SSL: out of memory creating CA certificate array"); 
-    return CURLE_OUT_OF_MEMORY; 
-  } 
- 
-  while(offset < buflen) { 
-    n++; 
- 
-    /* 
-     * Check if the certificate is in PEM format, and convert it to DER. If 
-     * this fails, we assume the certificate is in DER format. 
-     */ 
-    res = pem_to_der((const char *)certbuf + offset, &der, &derlen); 
-    if(res < 0) { 
-      free(certbuf); 
-      CFRelease(array); 
+  if(err != noErr) {
+    failf(data, "SSL: SSLSetConnection() failed: %d", err);
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+
+  connssl->connecting_state = ssl_connect_2;
+  return CURLE_OK;
+}
+
+static long pem_to_der(const char *in, unsigned char **out, size_t *outlen)
+{
+  char *sep_start, *sep_end, *cert_start, *cert_end;
+  size_t i, j, err;
+  size_t len;
+  unsigned char *b64;
+
+  /* Jump through the separators at the beginning of the certificate. */
+  sep_start = strstr(in, "-----");
+  if(sep_start == NULL)
+    return 0;
+  cert_start = strstr(sep_start + 1, "-----");
+  if(cert_start == NULL)
+    return -1;
+
+  cert_start += 5;
+
+  /* Find separator after the end of the certificate. */
+  cert_end = strstr(cert_start, "-----");
+  if(cert_end == NULL)
+    return -1;
+
+  sep_end = strstr(cert_end + 1, "-----");
+  if(sep_end == NULL)
+    return -1;
+  sep_end += 5;
+
+  len = cert_end - cert_start;
+  b64 = malloc(len + 1);
+  if(!b64)
+    return -1;
+
+  /* Create base64 string without linefeeds. */
+  for(i = 0, j = 0; i < len; i++) {
+    if(cert_start[i] != '\r' && cert_start[i] != '\n')
+      b64[j++] = cert_start[i];
+  }
+  b64[j] = '\0';
+
+  err = Curl_base64_decode((const char *)b64, out, outlen);
+  free(b64);
+  if(err) {
+    free(*out);
+    return -1;
+  }
+
+  return sep_end - in;
+}
+
+static int read_cert(const char *file, unsigned char **out, size_t *outlen)
+{
+  int fd;
+  ssize_t n, len = 0, cap = 512;
+  unsigned char buf[512], *data;
+
+  fd = open(file, 0);
+  if(fd < 0)
+    return -1;
+
+  data = malloc(cap);
+  if(!data) {
+    close(fd);
+    return -1;
+  }
+
+  for(;;) {
+    n = read(fd, buf, sizeof(buf));
+    if(n < 0) {
+      close(fd);
+      free(data);
+      return -1;
+    }
+    else if(n == 0) {
+      close(fd);
+      break;
+    }
+
+    if(len + n >= cap) {
+      cap *= 2;
+      data = Curl_saferealloc(data, cap);
+      if(!data) {
+        close(fd);
+        return -1;
+      }
+    }
+
+    memcpy(data + len, buf, n);
+    len += n;
+  }
+  data[len] = '\0';
+
+  *out = data;
+  *outlen = len;
+
+  return 0;
+}
+
+static int append_cert_to_array(struct Curl_easy *data,
+                                unsigned char *buf, size_t buflen,
+                                CFMutableArrayRef array)
+{
+    CFDataRef certdata = CFDataCreate(kCFAllocatorDefault, buf, buflen);
+    char *certp;
+    CURLcode result;
+    if(!certdata) {
+      failf(data, "SSL: failed to allocate array for CA certificate");
+      return CURLE_OUT_OF_MEMORY;
+    }
+
+    SecCertificateRef cacert =
+      SecCertificateCreateWithData(kCFAllocatorDefault, certdata);
+    CFRelease(certdata);
+    if(!cacert) {
+      failf(data, "SSL: failed to create SecCertificate from CA certificate");
+      return CURLE_SSL_CACERT_BADFILE;
+    }
+
+    /* Check if cacert is valid. */
+    result = CopyCertSubject(data, cacert, &certp);
+    switch(result) {
+      case CURLE_OK:
+        break;
+      case CURLE_PEER_FAILED_VERIFICATION:
+        return CURLE_SSL_CACERT_BADFILE;
+      case CURLE_OUT_OF_MEMORY:
+      default:
+        return result;
+    }
+    free(certp);
+
+    CFArrayAppendValue(array, cacert);
+    CFRelease(cacert);
+
+    return CURLE_OK;
+}
+
+static CURLcode verify_cert(const char *cafile, struct Curl_easy *data,
+                            SSLContextRef ctx)
+{
+  int n = 0, rc;
+  long res;
+  unsigned char *certbuf, *der;
+  size_t buflen, derlen, offset = 0;
+
+  if(read_cert(cafile, &certbuf, &buflen) < 0) {
+    failf(data, "SSL: failed to read or invalid CA certificate");
+    return CURLE_SSL_CACERT_BADFILE;
+  }
+
+  /*
+   * Certbuf now contains the contents of the certificate file, which can be
+   * - a single DER certificate,
+   * - a single PEM certificate or
+   * - a bunch of PEM certificates (certificate bundle).
+   *
+   * Go through certbuf, and convert any PEM certificate in it into DER
+   * format.
+   */
+  CFMutableArrayRef array = CFArrayCreateMutable(kCFAllocatorDefault, 0,
+                                                 &kCFTypeArrayCallBacks);
+  if(array == NULL) {
+    free(certbuf);
+    failf(data, "SSL: out of memory creating CA certificate array");
+    return CURLE_OUT_OF_MEMORY;
+  }
+
+  while(offset < buflen) {
+    n++;
+
+    /*
+     * Check if the certificate is in PEM format, and convert it to DER. If
+     * this fails, we assume the certificate is in DER format.
+     */
+    res = pem_to_der((const char *)certbuf + offset, &der, &derlen);
+    if(res < 0) {
+      free(certbuf);
+      CFRelease(array);
       failf(data, "SSL: invalid CA certificate #%d (offset %zu) in bundle",
-            n, offset); 
-      return CURLE_SSL_CACERT_BADFILE; 
-    } 
-    offset += res; 
- 
-    if(res == 0 && offset == 0) { 
-      /* This is not a PEM file, probably a certificate in DER format. */ 
-      rc = append_cert_to_array(data, certbuf, buflen, array); 
-      free(certbuf); 
-      if(rc != CURLE_OK) { 
-        CFRelease(array); 
-        return rc; 
-      } 
-      break; 
-    } 
-    else if(res == 0) { 
-      /* No more certificates in the bundle. */ 
-      free(certbuf); 
-      break; 
-    } 
- 
-    rc = append_cert_to_array(data, der, derlen, array); 
-    free(der); 
-    if(rc != CURLE_OK) { 
-      free(certbuf); 
-      CFRelease(array); 
-      return rc; 
-    } 
-  } 
- 
-  SecTrustRef trust; 
-  OSStatus ret = SSLCopyPeerTrust(ctx, &trust); 
-  if(trust == NULL) { 
-    failf(data, "SSL: error getting certificate chain"); 
-    CFRelease(array); 
-    return CURLE_PEER_FAILED_VERIFICATION; 
-  } 
-  else if(ret != noErr) { 
-    CFRelease(array); 
-    failf(data, "SSLCopyPeerTrust() returned error %d", ret); 
-    return CURLE_PEER_FAILED_VERIFICATION; 
-  } 
- 
-  ret = SecTrustSetAnchorCertificates(trust, array); 
-  if(ret != noErr) { 
-    CFRelease(array); 
-    CFRelease(trust); 
-    failf(data, "SecTrustSetAnchorCertificates() returned error %d", ret); 
-    return CURLE_PEER_FAILED_VERIFICATION; 
-  } 
-  ret = SecTrustSetAnchorCertificatesOnly(trust, true); 
-  if(ret != noErr) { 
-    CFRelease(array); 
-    CFRelease(trust); 
-    failf(data, "SecTrustSetAnchorCertificatesOnly() returned error %d", ret); 
-    return CURLE_PEER_FAILED_VERIFICATION; 
-  } 
- 
-  SecTrustResultType trust_eval = 0; 
-  ret = SecTrustEvaluate(trust, &trust_eval); 
-  CFRelease(array); 
-  CFRelease(trust); 
-  if(ret != noErr) { 
-    failf(data, "SecTrustEvaluate() returned error %d", ret); 
-    return CURLE_PEER_FAILED_VERIFICATION; 
-  } 
- 
-  switch(trust_eval) { 
-    case kSecTrustResultUnspecified: 
-    case kSecTrustResultProceed: 
-      return CURLE_OK; 
- 
-    case kSecTrustResultRecoverableTrustFailure: 
-    case kSecTrustResultDeny: 
-    default: 
-      failf(data, "SSL: certificate verification failed (result: %d)", 
-            trust_eval); 
-      return CURLE_PEER_FAILED_VERIFICATION; 
-  } 
-} 
- 
-#ifdef SECTRANSP_PINNEDPUBKEY 
-static CURLcode pkp_pin_peer_pubkey(struct Curl_easy *data, 
-                                    SSLContextRef ctx, 
-                                    const char *pinnedpubkey) 
-{  /* Scratch */ 
-  size_t pubkeylen, realpubkeylen, spkiHeaderLength = 24; 
-  unsigned char *pubkey = NULL, *realpubkey = NULL; 
-  const unsigned char *spkiHeader = NULL; 
-  CFDataRef publicKeyBits = NULL; 
- 
-  /* Result is returned to caller */ 
-  CURLcode result = CURLE_SSL_PINNEDPUBKEYNOTMATCH; 
- 
-  /* if a path wasn't specified, don't pin */ 
-  if(!pinnedpubkey) 
-    return CURLE_OK; 
- 
- 
-  if(!ctx) 
-    return result; 
- 
-  do { 
-    SecTrustRef trust; 
-    OSStatus ret = SSLCopyPeerTrust(ctx, &trust); 
-    if(ret != noErr || trust == NULL) 
-      break; 
- 
-    SecKeyRef keyRef = SecTrustCopyPublicKey(trust); 
-    CFRelease(trust); 
-    if(keyRef == NULL) 
-      break; 
- 
-#ifdef SECTRANSP_PINNEDPUBKEY_V1 
- 
-    publicKeyBits = SecKeyCopyExternalRepresentation(keyRef, NULL); 
-    CFRelease(keyRef); 
-    if(publicKeyBits == NULL) 
-      break; 
- 
-#elif SECTRANSP_PINNEDPUBKEY_V2 
- 
-    OSStatus success = SecItemExport(keyRef, kSecFormatOpenSSL, 0, NULL, 
-                                     &publicKeyBits); 
-    CFRelease(keyRef); 
-    if(success != errSecSuccess || publicKeyBits == NULL) 
-      break; 
- 
-#endif /* SECTRANSP_PINNEDPUBKEY_V2 */ 
- 
-    pubkeylen = CFDataGetLength(publicKeyBits); 
-    pubkey = (unsigned char *)CFDataGetBytePtr(publicKeyBits); 
- 
-    switch(pubkeylen) { 
-      case 526: 
-        /* 4096 bit RSA pubkeylen == 526 */ 
-        spkiHeader = rsa4096SpkiHeader; 
-        break; 
-      case 270: 
-        /* 2048 bit RSA pubkeylen == 270 */ 
-        spkiHeader = rsa2048SpkiHeader; 
-        break; 
-#ifdef SECTRANSP_PINNEDPUBKEY_V1 
-      case 65: 
-        /* ecDSA secp256r1 pubkeylen == 65 */ 
-        spkiHeader = ecDsaSecp256r1SpkiHeader; 
-        spkiHeaderLength = 26; 
-        break; 
-      case 97: 
-        /* ecDSA secp384r1 pubkeylen == 97 */ 
-        spkiHeader = ecDsaSecp384r1SpkiHeader; 
-        spkiHeaderLength = 23; 
-        break; 
-      default: 
-        infof(data, "SSL: unhandled public key length: %d\n", pubkeylen); 
-#elif SECTRANSP_PINNEDPUBKEY_V2 
-      default: 
-        /* ecDSA secp256r1 pubkeylen == 91 header already included? 
-         * ecDSA secp384r1 header already included too 
-         * we assume rest of algorithms do same, so do nothing 
-         */ 
-        result = Curl_pin_peer_pubkey(data, pinnedpubkey, pubkey, 
-                                    pubkeylen); 
-#endif /* SECTRANSP_PINNEDPUBKEY_V2 */ 
-        continue; /* break from loop */ 
-    } 
- 
-    realpubkeylen = pubkeylen + spkiHeaderLength; 
-    realpubkey = malloc(realpubkeylen); 
-    if(!realpubkey) 
-      break; 
- 
-    memcpy(realpubkey, spkiHeader, spkiHeaderLength); 
-    memcpy(realpubkey + spkiHeaderLength, pubkey, pubkeylen); 
- 
-    result = Curl_pin_peer_pubkey(data, pinnedpubkey, realpubkey, 
-                                  realpubkeylen); 
- 
-  } while(0); 
- 
-  Curl_safefree(realpubkey); 
-  if(publicKeyBits != NULL) 
-    CFRelease(publicKeyBits); 
- 
-  return result; 
-} 
-#endif /* SECTRANSP_PINNEDPUBKEY */ 
- 
-static CURLcode 
-sectransp_connect_step2(struct connectdata *conn, int sockindex) 
-{ 
-  struct Curl_easy *data = conn->data; 
-  struct ssl_connect_data *connssl = &conn->ssl[sockindex]; 
+            n, offset);
+      return CURLE_SSL_CACERT_BADFILE;
+    }
+    offset += res;
+
+    if(res == 0 && offset == 0) {
+      /* This is not a PEM file, probably a certificate in DER format. */
+      rc = append_cert_to_array(data, certbuf, buflen, array);
+      free(certbuf);
+      if(rc != CURLE_OK) {
+        CFRelease(array);
+        return rc;
+      }
+      break;
+    }
+    else if(res == 0) {
+      /* No more certificates in the bundle. */
+      free(certbuf);
+      break;
+    }
+
+    rc = append_cert_to_array(data, der, derlen, array);
+    free(der);
+    if(rc != CURLE_OK) {
+      free(certbuf);
+      CFRelease(array);
+      return rc;
+    }
+  }
+
+  SecTrustRef trust;
+  OSStatus ret = SSLCopyPeerTrust(ctx, &trust);
+  if(trust == NULL) {
+    failf(data, "SSL: error getting certificate chain");
+    CFRelease(array);
+    return CURLE_PEER_FAILED_VERIFICATION;
+  }
+  else if(ret != noErr) {
+    CFRelease(array);
+    failf(data, "SSLCopyPeerTrust() returned error %d", ret);
+    return CURLE_PEER_FAILED_VERIFICATION;
+  }
+
+  ret = SecTrustSetAnchorCertificates(trust, array);
+  if(ret != noErr) {
+    CFRelease(array);
+    CFRelease(trust);
+    failf(data, "SecTrustSetAnchorCertificates() returned error %d", ret);
+    return CURLE_PEER_FAILED_VERIFICATION;
+  }
+  ret = SecTrustSetAnchorCertificatesOnly(trust, true);
+  if(ret != noErr) {
+    CFRelease(array);
+    CFRelease(trust);
+    failf(data, "SecTrustSetAnchorCertificatesOnly() returned error %d", ret);
+    return CURLE_PEER_FAILED_VERIFICATION;
+  }
+
+  SecTrustResultType trust_eval = 0;
+  ret = SecTrustEvaluate(trust, &trust_eval);
+  CFRelease(array);
+  CFRelease(trust);
+  if(ret != noErr) {
+    failf(data, "SecTrustEvaluate() returned error %d", ret);
+    return CURLE_PEER_FAILED_VERIFICATION;
+  }
+
+  switch(trust_eval) {
+    case kSecTrustResultUnspecified:
+    case kSecTrustResultProceed:
+      return CURLE_OK;
+
+    case kSecTrustResultRecoverableTrustFailure:
+    case kSecTrustResultDeny:
+    default:
+      failf(data, "SSL: certificate verification failed (result: %d)",
+            trust_eval);
+      return CURLE_PEER_FAILED_VERIFICATION;
+  }
+}
+
+#ifdef SECTRANSP_PINNEDPUBKEY
+static CURLcode pkp_pin_peer_pubkey(struct Curl_easy *data,
+                                    SSLContextRef ctx,
+                                    const char *pinnedpubkey)
+{  /* Scratch */
+  size_t pubkeylen, realpubkeylen, spkiHeaderLength = 24;
+  unsigned char *pubkey = NULL, *realpubkey = NULL;
+  const unsigned char *spkiHeader = NULL;
+  CFDataRef publicKeyBits = NULL;
+
+  /* Result is returned to caller */
+  CURLcode result = CURLE_SSL_PINNEDPUBKEYNOTMATCH;
+
+  /* if a path wasn't specified, don't pin */
+  if(!pinnedpubkey)
+    return CURLE_OK;
+
+
+  if(!ctx)
+    return result;
+
+  do {
+    SecTrustRef trust;
+    OSStatus ret = SSLCopyPeerTrust(ctx, &trust);
+    if(ret != noErr || trust == NULL)
+      break;
+
+    SecKeyRef keyRef = SecTrustCopyPublicKey(trust);
+    CFRelease(trust);
+    if(keyRef == NULL)
+      break;
+
+#ifdef SECTRANSP_PINNEDPUBKEY_V1
+
+    publicKeyBits = SecKeyCopyExternalRepresentation(keyRef, NULL);
+    CFRelease(keyRef);
+    if(publicKeyBits == NULL)
+      break;
+
+#elif SECTRANSP_PINNEDPUBKEY_V2
+
+    OSStatus success = SecItemExport(keyRef, kSecFormatOpenSSL, 0, NULL,
+                                     &publicKeyBits);
+    CFRelease(keyRef);
+    if(success != errSecSuccess || publicKeyBits == NULL)
+      break;
+
+#endif /* SECTRANSP_PINNEDPUBKEY_V2 */
+
+    pubkeylen = CFDataGetLength(publicKeyBits);
+    pubkey = (unsigned char *)CFDataGetBytePtr(publicKeyBits);
+
+    switch(pubkeylen) {
+      case 526:
+        /* 4096 bit RSA pubkeylen == 526 */
+        spkiHeader = rsa4096SpkiHeader;
+        break;
+      case 270:
+        /* 2048 bit RSA pubkeylen == 270 */
+        spkiHeader = rsa2048SpkiHeader;
+        break;
+#ifdef SECTRANSP_PINNEDPUBKEY_V1
+      case 65:
+        /* ecDSA secp256r1 pubkeylen == 65 */
+        spkiHeader = ecDsaSecp256r1SpkiHeader;
+        spkiHeaderLength = 26;
+        break;
+      case 97:
+        /* ecDSA secp384r1 pubkeylen == 97 */
+        spkiHeader = ecDsaSecp384r1SpkiHeader;
+        spkiHeaderLength = 23;
+        break;
+      default:
+        infof(data, "SSL: unhandled public key length: %d\n", pubkeylen);
+#elif SECTRANSP_PINNEDPUBKEY_V2
+      default:
+        /* ecDSA secp256r1 pubkeylen == 91 header already included?
+         * ecDSA secp384r1 header already included too
+         * we assume rest of algorithms do same, so do nothing
+         */
+        result = Curl_pin_peer_pubkey(data, pinnedpubkey, pubkey,
+                                    pubkeylen);
+#endif /* SECTRANSP_PINNEDPUBKEY_V2 */
+        continue; /* break from loop */
+    }
+
+    realpubkeylen = pubkeylen + spkiHeaderLength;
+    realpubkey = malloc(realpubkeylen);
+    if(!realpubkey)
+      break;
+
+    memcpy(realpubkey, spkiHeader, spkiHeaderLength);
+    memcpy(realpubkey + spkiHeaderLength, pubkey, pubkeylen);
+
+    result = Curl_pin_peer_pubkey(data, pinnedpubkey, realpubkey,
+                                  realpubkeylen);
+
+  } while(0);
+
+  Curl_safefree(realpubkey);
+  if(publicKeyBits != NULL)
+    CFRelease(publicKeyBits);
+
+  return result;
+}
+#endif /* SECTRANSP_PINNEDPUBKEY */
+
+static CURLcode
+sectransp_connect_step2(struct connectdata *conn, int sockindex)
+{
+  struct Curl_easy *data = conn->data;
+  struct ssl_connect_data *connssl = &conn->ssl[sockindex];
   struct ssl_backend_data *backend = connssl->backend;
-  OSStatus err; 
-  SSLCipherSuite cipher; 
-  SSLProtocol protocol = 0; 
+  OSStatus err;
+  SSLCipherSuite cipher;
+  SSLProtocol protocol = 0;
 #ifndef CURL_DISABLE_PROXY
-  const char * const hostname = SSL_IS_PROXY() ? conn->http_proxy.host.name : 
-    conn->host.name; 
+  const char * const hostname = SSL_IS_PROXY() ? conn->http_proxy.host.name :
+    conn->host.name;
 #else
   const char * const hostname = conn->host.name;
 #endif
- 
-  DEBUGASSERT(ssl_connect_2 == connssl->connecting_state 
-              || ssl_connect_2_reading == connssl->connecting_state 
-              || ssl_connect_2_writing == connssl->connecting_state); 
- 
-  /* Here goes nothing: */ 
+
+  DEBUGASSERT(ssl_connect_2 == connssl->connecting_state
+              || ssl_connect_2_reading == connssl->connecting_state
+              || ssl_connect_2_writing == connssl->connecting_state);
+
+  /* Here goes nothing: */
   err = SSLHandshake(backend->ssl_ctx);
- 
-  if(err != noErr) { 
-    switch(err) { 
-      case errSSLWouldBlock:  /* they're not done with us yet */ 
+
+  if(err != noErr) {
+    switch(err) {
+      case errSSLWouldBlock:  /* they're not done with us yet */
         connssl->connecting_state = backend->ssl_direction ?
-            ssl_connect_2_writing : ssl_connect_2_reading; 
-        return CURLE_OK; 
- 
-      /* The below is errSSLServerAuthCompleted; it's not defined in 
-        Leopard's headers */ 
-      case -9841: 
-        if(SSL_CONN_CONFIG(CAfile) && SSL_CONN_CONFIG(verifypeer)) { 
-          CURLcode result = verify_cert(SSL_CONN_CONFIG(CAfile), data, 
+            ssl_connect_2_writing : ssl_connect_2_reading;
+        return CURLE_OK;
+
+      /* The below is errSSLServerAuthCompleted; it's not defined in
+        Leopard's headers */
+      case -9841:
+        if(SSL_CONN_CONFIG(CAfile) && SSL_CONN_CONFIG(verifypeer)) {
+          CURLcode result = verify_cert(SSL_CONN_CONFIG(CAfile), data,
                                         backend->ssl_ctx);
-          if(result) 
-            return result; 
-        } 
-        /* the documentation says we need to call SSLHandshake() again */ 
-        return sectransp_connect_step2(conn, sockindex); 
- 
-      /* Problem with encrypt / decrypt */ 
-      case errSSLPeerDecodeError: 
-        failf(data, "Decode failed"); 
-        break; 
-      case errSSLDecryptionFail: 
-      case errSSLPeerDecryptionFail: 
-        failf(data, "Decryption failed"); 
-        break; 
-      case errSSLPeerDecryptError: 
-        failf(data, "A decryption error occurred"); 
-        break; 
-      case errSSLBadCipherSuite: 
-        failf(data, "A bad SSL cipher suite was encountered"); 
-        break; 
-      case errSSLCrypto: 
-        failf(data, "An underlying cryptographic error was encountered"); 
-        break; 
-#if CURL_BUILD_MAC_10_11 || CURL_BUILD_IOS_9 
-      case errSSLWeakPeerEphemeralDHKey: 
-        failf(data, "Indicates a weak ephemeral Diffie-Hellman key"); 
-        break; 
-#endif 
- 
-      /* Problem with the message record validation */ 
-      case errSSLBadRecordMac: 
-      case errSSLPeerBadRecordMac: 
-        failf(data, "A record with a bad message authentication code (MAC) " 
-                    "was encountered"); 
-        break; 
-      case errSSLRecordOverflow: 
-      case errSSLPeerRecordOverflow: 
-        failf(data, "A record overflow occurred"); 
-        break; 
- 
-      /* Problem with zlib decompression */ 
-      case errSSLPeerDecompressFail: 
-        failf(data, "Decompression failed"); 
-        break; 
- 
-      /* Problem with access */ 
-      case errSSLPeerAccessDenied: 
-        failf(data, "Access was denied"); 
-        break; 
-      case errSSLPeerInsufficientSecurity: 
-        failf(data, "There is insufficient security for this operation"); 
-        break; 
- 
-      /* These are all certificate problems with the server: */ 
-      case errSSLXCertChainInvalid: 
-        failf(data, "SSL certificate problem: Invalid certificate chain"); 
-        return CURLE_PEER_FAILED_VERIFICATION; 
-      case errSSLUnknownRootCert: 
-        failf(data, "SSL certificate problem: Untrusted root certificate"); 
-        return CURLE_PEER_FAILED_VERIFICATION; 
-      case errSSLNoRootCert: 
-        failf(data, "SSL certificate problem: No root certificate"); 
-        return CURLE_PEER_FAILED_VERIFICATION; 
-      case errSSLCertNotYetValid: 
-        failf(data, "SSL certificate problem: The certificate chain had a " 
-                    "certificate that is not yet valid"); 
-        return CURLE_PEER_FAILED_VERIFICATION; 
-      case errSSLCertExpired: 
-      case errSSLPeerCertExpired: 
-        failf(data, "SSL certificate problem: Certificate chain had an " 
-              "expired certificate"); 
-        return CURLE_PEER_FAILED_VERIFICATION; 
-      case errSSLBadCert: 
-      case errSSLPeerBadCert: 
-        failf(data, "SSL certificate problem: Couldn't understand the server " 
-              "certificate format"); 
-        return CURLE_PEER_FAILED_VERIFICATION; 
-      case errSSLPeerUnsupportedCert: 
-        failf(data, "SSL certificate problem: An unsupported certificate " 
-                    "format was encountered"); 
-        return CURLE_PEER_FAILED_VERIFICATION; 
-      case errSSLPeerCertRevoked: 
-        failf(data, "SSL certificate problem: The certificate was revoked"); 
-        return CURLE_PEER_FAILED_VERIFICATION; 
-      case errSSLPeerCertUnknown: 
-        failf(data, "SSL certificate problem: The certificate is unknown"); 
-        return CURLE_PEER_FAILED_VERIFICATION; 
- 
-      /* These are all certificate problems with the client: */ 
-      case errSecAuthFailed: 
-        failf(data, "SSL authentication failed"); 
-        break; 
-      case errSSLPeerHandshakeFail: 
-        failf(data, "SSL peer handshake failed, the server most likely " 
-              "requires a client certificate to connect"); 
-        break; 
-      case errSSLPeerUnknownCA: 
-        failf(data, "SSL server rejected the client certificate due to " 
-              "the certificate being signed by an unknown certificate " 
-              "authority"); 
-        break; 
- 
-      /* This error is raised if the server's cert didn't match the server's 
-         host name: */ 
-      case errSSLHostNameMismatch: 
-        failf(data, "SSL certificate peer verification failed, the " 
-              "certificate did not match \"%s\"\n", conn->host.dispname); 
-        return CURLE_PEER_FAILED_VERIFICATION; 
- 
-      /* Problem with SSL / TLS negotiation */ 
-      case errSSLNegotiation: 
-        failf(data, "Could not negotiate an SSL cipher suite with the server"); 
-        break; 
-      case errSSLBadConfiguration: 
-        failf(data, "A configuration error occurred"); 
-        break; 
-      case errSSLProtocol: 
-        failf(data, "SSL protocol error"); 
-        break; 
-      case errSSLPeerProtocolVersion: 
-        failf(data, "A bad protocol version was encountered"); 
-        break; 
-      case errSSLPeerNoRenegotiation: 
-        failf(data, "No renegotiation is allowed"); 
-        break; 
- 
-      /* Generic handshake errors: */ 
-      case errSSLConnectionRefused: 
-        failf(data, "Server dropped the connection during the SSL handshake"); 
-        break; 
-      case errSSLClosedAbort: 
-        failf(data, "Server aborted the SSL handshake"); 
-        break; 
-      case errSSLClosedGraceful: 
-        failf(data, "The connection closed gracefully"); 
-        break; 
-      case errSSLClosedNoNotify: 
-        failf(data, "The server closed the session with no notification"); 
-        break; 
-      /* Sometimes paramErr happens with buggy ciphers: */ 
-      case paramErr: 
-      case errSSLInternal: 
-      case errSSLPeerInternalError: 
-        failf(data, "Internal SSL engine error encountered during the " 
-              "SSL handshake"); 
-        break; 
-      case errSSLFatalAlert: 
-        failf(data, "Fatal SSL engine error encountered during the SSL " 
-              "handshake"); 
-        break; 
-      /* Unclassified error */ 
-      case errSSLBufferOverflow: 
-        failf(data, "An insufficient buffer was provided"); 
-        break; 
-      case errSSLIllegalParam: 
-        failf(data, "An illegal parameter was encountered"); 
-        break; 
-      case errSSLModuleAttach: 
-        failf(data, "Module attach failure"); 
-        break; 
-      case errSSLSessionNotFound: 
-        failf(data, "An attempt to restore an unknown session failed"); 
-        break; 
-      case errSSLPeerExportRestriction: 
-        failf(data, "An export restriction occurred"); 
-        break; 
-      case errSSLPeerUserCancelled: 
-        failf(data, "The user canceled the operation"); 
-        break; 
-      case errSSLPeerUnexpectedMsg: 
-        failf(data, "Peer rejected unexpected message"); 
-        break; 
-#if CURL_BUILD_MAC_10_11 || CURL_BUILD_IOS_9 
-      /* Treaing non-fatal error as fatal like before */ 
-      case errSSLClientHelloReceived: 
-        failf(data, "A non-fatal result for providing a server name " 
-                    "indication"); 
-        break; 
-#endif 
- 
-      /* Error codes defined in the enum but should never be returned. 
-         We list them here just in case. */ 
-#if CURL_BUILD_MAC_10_6 
-      /* Only returned when kSSLSessionOptionBreakOnCertRequested is set */ 
-      case errSSLClientCertRequested: 
-        failf(data, "The server has requested a client certificate"); 
-        break; 
-#endif 
-#if CURL_BUILD_MAC_10_9 
-      /* Alias for errSSLLast, end of error range */ 
-      case errSSLUnexpectedRecord: 
-        failf(data, "Unexpected (skipped) record in DTLS"); 
-        break; 
-#endif 
-      default: 
-        /* May also return codes listed in Security Framework Result Codes */ 
-        failf(data, "Unknown SSL protocol error in connection to %s:%d", 
-              hostname, err); 
-        break; 
-    } 
-    return CURLE_SSL_CONNECT_ERROR; 
-  } 
-  else { 
-    /* we have been connected fine, we're not waiting for anything else. */ 
-    connssl->connecting_state = ssl_connect_3; 
- 
-#ifdef SECTRANSP_PINNEDPUBKEY 
-    if(data->set.str[STRING_SSL_PINNEDPUBLICKEY_ORIG]) { 
+          if(result)
+            return result;
+        }
+        /* the documentation says we need to call SSLHandshake() again */
+        return sectransp_connect_step2(conn, sockindex);
+
+      /* Problem with encrypt / decrypt */
+      case errSSLPeerDecodeError:
+        failf(data, "Decode failed");
+        break;
+      case errSSLDecryptionFail:
+      case errSSLPeerDecryptionFail:
+        failf(data, "Decryption failed");
+        break;
+      case errSSLPeerDecryptError:
+        failf(data, "A decryption error occurred");
+        break;
+      case errSSLBadCipherSuite:
+        failf(data, "A bad SSL cipher suite was encountered");
+        break;
+      case errSSLCrypto:
+        failf(data, "An underlying cryptographic error was encountered");
+        break;
+#if CURL_BUILD_MAC_10_11 || CURL_BUILD_IOS_9
+      case errSSLWeakPeerEphemeralDHKey:
+        failf(data, "Indicates a weak ephemeral Diffie-Hellman key");
+        break;
+#endif
+
+      /* Problem with the message record validation */
+      case errSSLBadRecordMac:
+      case errSSLPeerBadRecordMac:
+        failf(data, "A record with a bad message authentication code (MAC) "
+                    "was encountered");
+        break;
+      case errSSLRecordOverflow:
+      case errSSLPeerRecordOverflow:
+        failf(data, "A record overflow occurred");
+        break;
+
+      /* Problem with zlib decompression */
+      case errSSLPeerDecompressFail:
+        failf(data, "Decompression failed");
+        break;
+
+      /* Problem with access */
+      case errSSLPeerAccessDenied:
+        failf(data, "Access was denied");
+        break;
+      case errSSLPeerInsufficientSecurity:
+        failf(data, "There is insufficient security for this operation");
+        break;
+
+      /* These are all certificate problems with the server: */
+      case errSSLXCertChainInvalid:
+        failf(data, "SSL certificate problem: Invalid certificate chain");
+        return CURLE_PEER_FAILED_VERIFICATION;
+      case errSSLUnknownRootCert:
+        failf(data, "SSL certificate problem: Untrusted root certificate");
+        return CURLE_PEER_FAILED_VERIFICATION;
+      case errSSLNoRootCert:
+        failf(data, "SSL certificate problem: No root certificate");
+        return CURLE_PEER_FAILED_VERIFICATION;
+      case errSSLCertNotYetValid:
+        failf(data, "SSL certificate problem: The certificate chain had a "
+                    "certificate that is not yet valid");
+        return CURLE_PEER_FAILED_VERIFICATION;
+      case errSSLCertExpired:
+      case errSSLPeerCertExpired:
+        failf(data, "SSL certificate problem: Certificate chain had an "
+              "expired certificate");
+        return CURLE_PEER_FAILED_VERIFICATION;
+      case errSSLBadCert:
+      case errSSLPeerBadCert:
+        failf(data, "SSL certificate problem: Couldn't understand the server "
+              "certificate format");
+        return CURLE_PEER_FAILED_VERIFICATION;
+      case errSSLPeerUnsupportedCert:
+        failf(data, "SSL certificate problem: An unsupported certificate "
+                    "format was encountered");
+        return CURLE_PEER_FAILED_VERIFICATION;
+      case errSSLPeerCertRevoked:
+        failf(data, "SSL certificate problem: The certificate was revoked");
+        return CURLE_PEER_FAILED_VERIFICATION;
+      case errSSLPeerCertUnknown:
+        failf(data, "SSL certificate problem: The certificate is unknown");
+        return CURLE_PEER_FAILED_VERIFICATION;
+
+      /* These are all certificate problems with the client: */
+      case errSecAuthFailed:
+        failf(data, "SSL authentication failed");
+        break;
+      case errSSLPeerHandshakeFail:
+        failf(data, "SSL peer handshake failed, the server most likely "
+              "requires a client certificate to connect");
+        break;
+      case errSSLPeerUnknownCA:
+        failf(data, "SSL server rejected the client certificate due to "
+              "the certificate being signed by an unknown certificate "
+              "authority");
+        break;
+
+      /* This error is raised if the server's cert didn't match the server's
+         host name: */
+      case errSSLHostNameMismatch:
+        failf(data, "SSL certificate peer verification failed, the "
+              "certificate did not match \"%s\"\n", conn->host.dispname);
+        return CURLE_PEER_FAILED_VERIFICATION;
+
+      /* Problem with SSL / TLS negotiation */
+      case errSSLNegotiation:
+        failf(data, "Could not negotiate an SSL cipher suite with the server");
+        break;
+      case errSSLBadConfiguration:
+        failf(data, "A configuration error occurred");
+        break;
+      case errSSLProtocol:
+        failf(data, "SSL protocol error");
+        break;
+      case errSSLPeerProtocolVersion:
+        failf(data, "A bad protocol version was encountered");
+        break;
+      case errSSLPeerNoRenegotiation:
+        failf(data, "No renegotiation is allowed");
+        break;
+
+      /* Generic handshake errors: */
+      case errSSLConnectionRefused:
+        failf(data, "Server dropped the connection during the SSL handshake");
+        break;
+      case errSSLClosedAbort:
+        failf(data, "Server aborted the SSL handshake");
+        break;
+      case errSSLClosedGraceful:
+        failf(data, "The connection closed gracefully");
+        break;
+      case errSSLClosedNoNotify:
+        failf(data, "The server closed the session with no notification");
+        break;
+      /* Sometimes paramErr happens with buggy ciphers: */
+      case paramErr:
+      case errSSLInternal:
+      case errSSLPeerInternalError:
+        failf(data, "Internal SSL engine error encountered during the "
+              "SSL handshake");
+        break;
+      case errSSLFatalAlert:
+        failf(data, "Fatal SSL engine error encountered during the SSL "
+              "handshake");
+        break;
+      /* Unclassified error */
+      case errSSLBufferOverflow:
+        failf(data, "An insufficient buffer was provided");
+        break;
+      case errSSLIllegalParam:
+        failf(data, "An illegal parameter was encountered");
+        break;
+      case errSSLModuleAttach:
+        failf(data, "Module attach failure");
+        break;
+      case errSSLSessionNotFound:
+        failf(data, "An attempt to restore an unknown session failed");
+        break;
+      case errSSLPeerExportRestriction:
+        failf(data, "An export restriction occurred");
+        break;
+      case errSSLPeerUserCancelled:
+        failf(data, "The user canceled the operation");
+        break;
+      case errSSLPeerUnexpectedMsg:
+        failf(data, "Peer rejected unexpected message");
+        break;
+#if CURL_BUILD_MAC_10_11 || CURL_BUILD_IOS_9
+      /* Treaing non-fatal error as fatal like before */
+      case errSSLClientHelloReceived:
+        failf(data, "A non-fatal result for providing a server name "
+                    "indication");
+        break;
+#endif
+
+      /* Error codes defined in the enum but should never be returned.
+         We list them here just in case. */
+#if CURL_BUILD_MAC_10_6
+      /* Only returned when kSSLSessionOptionBreakOnCertRequested is set */
+      case errSSLClientCertRequested:
+        failf(data, "The server has requested a client certificate");
+        break;
+#endif
+#if CURL_BUILD_MAC_10_9
+      /* Alias for errSSLLast, end of error range */
+      case errSSLUnexpectedRecord:
+        failf(data, "Unexpected (skipped) record in DTLS");
+        break;
+#endif
+      default:
+        /* May also return codes listed in Security Framework Result Codes */
+        failf(data, "Unknown SSL protocol error in connection to %s:%d",
+              hostname, err);
+        break;
+    }
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+  else {
+    /* we have been connected fine, we're not waiting for anything else. */
+    connssl->connecting_state = ssl_connect_3;
+
+#ifdef SECTRANSP_PINNEDPUBKEY
+    if(data->set.str[STRING_SSL_PINNEDPUBLICKEY_ORIG]) {
       CURLcode result = pkp_pin_peer_pubkey(data, backend->ssl_ctx,
-                            data->set.str[STRING_SSL_PINNEDPUBLICKEY_ORIG]); 
-      if(result) { 
-        failf(data, "SSL: public key does not match pinned public key!"); 
-        return result; 
-      } 
-    } 
-#endif /* SECTRANSP_PINNEDPUBKEY */ 
- 
-    /* Informational message */ 
+                            data->set.str[STRING_SSL_PINNEDPUBLICKEY_ORIG]);
+      if(result) {
+        failf(data, "SSL: public key does not match pinned public key!");
+        return result;
+      }
+    }
+#endif /* SECTRANSP_PINNEDPUBKEY */
+
+    /* Informational message */
     (void)SSLGetNegotiatedCipher(backend->ssl_ctx, &cipher);
     (void)SSLGetNegotiatedProtocolVersion(backend->ssl_ctx, &protocol);
-    switch(protocol) { 
-      case kSSLProtocol2: 
-        infof(data, "SSL 2.0 connection using %s\n", 
-              SSLCipherNameForNumber(cipher)); 
-        break; 
-      case kSSLProtocol3: 
-        infof(data, "SSL 3.0 connection using %s\n", 
-              SSLCipherNameForNumber(cipher)); 
-        break; 
-      case kTLSProtocol1: 
-        infof(data, "TLS 1.0 connection using %s\n", 
-              TLSCipherNameForNumber(cipher)); 
-        break; 
-#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS 
-      case kTLSProtocol11: 
-        infof(data, "TLS 1.1 connection using %s\n", 
-              TLSCipherNameForNumber(cipher)); 
-        break; 
-      case kTLSProtocol12: 
-        infof(data, "TLS 1.2 connection using %s\n", 
-              TLSCipherNameForNumber(cipher)); 
-        break; 
-#endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */ 
-#if CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11 
-      case kTLSProtocol13: 
-        infof(data, "TLS 1.3 connection using %s\n", 
-              TLSCipherNameForNumber(cipher)); 
-        break; 
-#endif /* CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11 */ 
-      default: 
-        infof(data, "Unknown protocol connection\n"); 
-        break; 
-    } 
- 
-#if(CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) && HAVE_BUILTIN_AVAILABLE == 1 
-    if(conn->bits.tls_enable_alpn) { 
-      if(__builtin_available(macOS 10.13.4, iOS 11, tvOS 11, *)) { 
-        CFArrayRef alpnArr = NULL; 
-        CFStringRef chosenProtocol = NULL; 
+    switch(protocol) {
+      case kSSLProtocol2:
+        infof(data, "SSL 2.0 connection using %s\n",
+              SSLCipherNameForNumber(cipher));
+        break;
+      case kSSLProtocol3:
+        infof(data, "SSL 3.0 connection using %s\n",
+              SSLCipherNameForNumber(cipher));
+        break;
+      case kTLSProtocol1:
+        infof(data, "TLS 1.0 connection using %s\n",
+              TLSCipherNameForNumber(cipher));
+        break;
+#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
+      case kTLSProtocol11:
+        infof(data, "TLS 1.1 connection using %s\n",
+              TLSCipherNameForNumber(cipher));
+        break;
+      case kTLSProtocol12:
+        infof(data, "TLS 1.2 connection using %s\n",
+              TLSCipherNameForNumber(cipher));
+        break;
+#endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */
+#if CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11
+      case kTLSProtocol13:
+        infof(data, "TLS 1.3 connection using %s\n",
+              TLSCipherNameForNumber(cipher));
+        break;
+#endif /* CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11 */
+      default:
+        infof(data, "Unknown protocol connection\n");
+        break;
+    }
+
+#if(CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) && HAVE_BUILTIN_AVAILABLE == 1
+    if(conn->bits.tls_enable_alpn) {
+      if(__builtin_available(macOS 10.13.4, iOS 11, tvOS 11, *)) {
+        CFArrayRef alpnArr = NULL;
+        CFStringRef chosenProtocol = NULL;
         err = SSLCopyALPNProtocols(backend->ssl_ctx, &alpnArr);
- 
-        if(err == noErr && alpnArr && CFArrayGetCount(alpnArr) >= 1) 
-          chosenProtocol = CFArrayGetValueAtIndex(alpnArr, 0); 
- 
-#ifdef USE_NGHTTP2 
-        if(chosenProtocol && 
-           !CFStringCompare(chosenProtocol, CFSTR(NGHTTP2_PROTO_VERSION_ID), 
-                            0)) { 
-          conn->negnpn = CURL_HTTP_VERSION_2; 
-        } 
-        else 
-#endif 
-        if(chosenProtocol && 
-           !CFStringCompare(chosenProtocol, CFSTR(ALPN_HTTP_1_1), 0)) { 
-          conn->negnpn = CURL_HTTP_VERSION_1_1; 
-        } 
-        else 
-          infof(data, "ALPN, server did not agree to a protocol\n"); 
- 
-        Curl_multiuse_state(conn, conn->negnpn == CURL_HTTP_VERSION_2 ? 
-                            BUNDLE_MULTIPLEX : BUNDLE_NO_MULTIUSE); 
- 
-        /* chosenProtocol is a reference to the string within alpnArr 
-           and doesn't need to be freed separately */ 
-        if(alpnArr) 
-          CFRelease(alpnArr); 
-      } 
-    } 
-#endif 
- 
-    return CURLE_OK; 
-  } 
-} 
- 
-#ifndef CURL_DISABLE_VERBOSE_STRINGS 
-/* This should be called during step3 of the connection at the earliest */ 
-static void 
-show_verbose_server_cert(struct connectdata *conn, 
-                         int sockindex) 
-{ 
-  struct Curl_easy *data = conn->data; 
-  struct ssl_connect_data *connssl = &conn->ssl[sockindex]; 
+
+        if(err == noErr && alpnArr && CFArrayGetCount(alpnArr) >= 1)
+          chosenProtocol = CFArrayGetValueAtIndex(alpnArr, 0);
+
+#ifdef USE_NGHTTP2
+        if(chosenProtocol &&
+           !CFStringCompare(chosenProtocol, CFSTR(NGHTTP2_PROTO_VERSION_ID),
+                            0)) {
+          conn->negnpn = CURL_HTTP_VERSION_2;
+        }
+        else
+#endif
+        if(chosenProtocol &&
+           !CFStringCompare(chosenProtocol, CFSTR(ALPN_HTTP_1_1), 0)) {
+          conn->negnpn = CURL_HTTP_VERSION_1_1;
+        }
+        else
+          infof(data, "ALPN, server did not agree to a protocol\n");
+
+        Curl_multiuse_state(conn, conn->negnpn == CURL_HTTP_VERSION_2 ?
+                            BUNDLE_MULTIPLEX : BUNDLE_NO_MULTIUSE);
+
+        /* chosenProtocol is a reference to the string within alpnArr
+           and doesn't need to be freed separately */
+        if(alpnArr)
+          CFRelease(alpnArr);
+      }
+    }
+#endif
+
+    return CURLE_OK;
+  }
+}
+
+#ifndef CURL_DISABLE_VERBOSE_STRINGS
+/* This should be called during step3 of the connection at the earliest */
+static void
+show_verbose_server_cert(struct connectdata *conn,
+                         int sockindex)
+{
+  struct Curl_easy *data = conn->data;
+  struct ssl_connect_data *connssl = &conn->ssl[sockindex];
   struct ssl_backend_data *backend = connssl->backend;
-  CFArrayRef server_certs = NULL; 
-  SecCertificateRef server_cert; 
-  OSStatus err; 
-  CFIndex i, count; 
-  SecTrustRef trust = NULL; 
- 
+  CFArrayRef server_certs = NULL;
+  SecCertificateRef server_cert;
+  OSStatus err;
+  CFIndex i, count;
+  SecTrustRef trust = NULL;
+
   if(!backend->ssl_ctx)
-    return; 
- 
-#if CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS 
-#if CURL_BUILD_IOS 
-#pragma unused(server_certs) 
+    return;
+
+#if CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS
+#if CURL_BUILD_IOS
+#pragma unused(server_certs)
   err = SSLCopyPeerTrust(backend->ssl_ctx, &trust);
-  /* For some reason, SSLCopyPeerTrust() can return noErr and yet return 
-     a null trust, so be on guard for that: */ 
-  if(err == noErr && trust) { 
-    count = SecTrustGetCertificateCount(trust); 
-    for(i = 0L ; i < count ; i++) { 
-      CURLcode result; 
-      char *certp; 
-      server_cert = SecTrustGetCertificateAtIndex(trust, i); 
-      result = CopyCertSubject(data, server_cert, &certp); 
-      if(!result) { 
-        infof(data, "Server certificate: %s\n", certp); 
-        free(certp); 
-      } 
-    } 
-    CFRelease(trust); 
-  } 
-#else 
-  /* SSLCopyPeerCertificates() is deprecated as of Mountain Lion. 
-     The function SecTrustGetCertificateAtIndex() is officially present 
-     in Lion, but it is unfortunately also present in Snow Leopard as 
-     private API and doesn't work as expected. So we have to look for 
-     a different symbol to make sure this code is only executed under 
-     Lion or later. */ 
-  if(SecTrustEvaluateAsync != NULL) { 
-#pragma unused(server_certs) 
+  /* For some reason, SSLCopyPeerTrust() can return noErr and yet return
+     a null trust, so be on guard for that: */
+  if(err == noErr && trust) {
+    count = SecTrustGetCertificateCount(trust);
+    for(i = 0L ; i < count ; i++) {
+      CURLcode result;
+      char *certp;
+      server_cert = SecTrustGetCertificateAtIndex(trust, i);
+      result = CopyCertSubject(data, server_cert, &certp);
+      if(!result) {
+        infof(data, "Server certificate: %s\n", certp);
+        free(certp);
+      }
+    }
+    CFRelease(trust);
+  }
+#else
+  /* SSLCopyPeerCertificates() is deprecated as of Mountain Lion.
+     The function SecTrustGetCertificateAtIndex() is officially present
+     in Lion, but it is unfortunately also present in Snow Leopard as
+     private API and doesn't work as expected. So we have to look for
+     a different symbol to make sure this code is only executed under
+     Lion or later. */
+  if(SecTrustEvaluateAsync != NULL) {
+#pragma unused(server_certs)
     err = SSLCopyPeerTrust(backend->ssl_ctx, &trust);
-    /* For some reason, SSLCopyPeerTrust() can return noErr and yet return 
-       a null trust, so be on guard for that: */ 
-    if(err == noErr && trust) { 
-      count = SecTrustGetCertificateCount(trust); 
-      for(i = 0L ; i < count ; i++) { 
-        char *certp; 
-        CURLcode result; 
-        server_cert = SecTrustGetCertificateAtIndex(trust, i); 
-        result = CopyCertSubject(data, server_cert, &certp); 
-        if(!result) { 
-          infof(data, "Server certificate: %s\n", certp); 
-          free(certp); 
-        } 
-      } 
-      CFRelease(trust); 
-    } 
-  } 
-  else { 
-#if CURL_SUPPORT_MAC_10_8 
+    /* For some reason, SSLCopyPeerTrust() can return noErr and yet return
+       a null trust, so be on guard for that: */
+    if(err == noErr && trust) {
+      count = SecTrustGetCertificateCount(trust);
+      for(i = 0L ; i < count ; i++) {
+        char *certp;
+        CURLcode result;
+        server_cert = SecTrustGetCertificateAtIndex(trust, i);
+        result = CopyCertSubject(data, server_cert, &certp);
+        if(!result) {
+          infof(data, "Server certificate: %s\n", certp);
+          free(certp);
+        }
+      }
+      CFRelease(trust);
+    }
+  }
+  else {
+#if CURL_SUPPORT_MAC_10_8
     err = SSLCopyPeerCertificates(backend->ssl_ctx, &server_certs);
-    /* Just in case SSLCopyPeerCertificates() returns null too... */ 
-    if(err == noErr && server_certs) { 
-      count = CFArrayGetCount(server_certs); 
-      for(i = 0L ; i < count ; i++) { 
-        char *certp; 
-        CURLcode result; 
-        server_cert = (SecCertificateRef)CFArrayGetValueAtIndex(server_certs, 
-                                                                i); 
-        result = CopyCertSubject(data, server_cert, &certp); 
-        if(!result) { 
-          infof(data, "Server certificate: %s\n", certp); 
-          free(certp); 
-        } 
-      } 
-      CFRelease(server_certs); 
-    } 
-#endif /* CURL_SUPPORT_MAC_10_8 */ 
-  } 
-#endif /* CURL_BUILD_IOS */ 
-#else 
-#pragma unused(trust) 
+    /* Just in case SSLCopyPeerCertificates() returns null too... */
+    if(err == noErr && server_certs) {
+      count = CFArrayGetCount(server_certs);
+      for(i = 0L ; i < count ; i++) {
+        char *certp;
+        CURLcode result;
+        server_cert = (SecCertificateRef)CFArrayGetValueAtIndex(server_certs,
+                                                                i);
+        result = CopyCertSubject(data, server_cert, &certp);
+        if(!result) {
+          infof(data, "Server certificate: %s\n", certp);
+          free(certp);
+        }
+      }
+      CFRelease(server_certs);
+    }
+#endif /* CURL_SUPPORT_MAC_10_8 */
+  }
+#endif /* CURL_BUILD_IOS */
+#else
+#pragma unused(trust)
   err = SSLCopyPeerCertificates(backend->ssl_ctx, &server_certs);
-  if(err == noErr) { 
-    count = CFArrayGetCount(server_certs); 
-    for(i = 0L ; i < count ; i++) { 
-      CURLcode result; 
-      char *certp; 
-      server_cert = (SecCertificateRef)CFArrayGetValueAtIndex(server_certs, i); 
-      result = CopyCertSubject(data, server_cert, &certp); 
-      if(!result) { 
-        infof(data, "Server certificate: %s\n", certp); 
-        free(certp); 
-      } 
-    } 
-    CFRelease(server_certs); 
-  } 
-#endif /* CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS */ 
-} 
-#endif /* !CURL_DISABLE_VERBOSE_STRINGS */ 
- 
-static CURLcode 
-sectransp_connect_step3(struct connectdata *conn, 
-                        int sockindex) 
-{ 
-  struct Curl_easy *data = conn->data; 
-  struct ssl_connect_data *connssl = &conn->ssl[sockindex]; 
- 
-  /* There is no step 3! 
-   * Well, okay, if verbose mode is on, let's print the details of the 
-   * server certificates. */ 
-#ifndef CURL_DISABLE_VERBOSE_STRINGS 
-  if(data->set.verbose) 
-    show_verbose_server_cert(conn, sockindex); 
-#endif 
- 
-  connssl->connecting_state = ssl_connect_done; 
-  return CURLE_OK; 
-} 
- 
-static Curl_recv sectransp_recv; 
-static Curl_send sectransp_send; 
- 
-static CURLcode 
-sectransp_connect_common(struct connectdata *conn, 
-                         int sockindex, 
-                         bool nonblocking, 
-                         bool *done) 
-{ 
-  CURLcode result; 
-  struct Curl_easy *data = conn->data; 
-  struct ssl_connect_data *connssl = &conn->ssl[sockindex]; 
-  curl_socket_t sockfd = conn->sock[sockindex]; 
-  int what; 
- 
-  /* check if the connection has already been established */ 
-  if(ssl_connection_complete == connssl->state) { 
-    *done = TRUE; 
-    return CURLE_OK; 
-  } 
- 
-  if(ssl_connect_1 == connssl->connecting_state) { 
-    /* Find out how much more time we're allowed */ 
+  if(err == noErr) {
+    count = CFArrayGetCount(server_certs);
+    for(i = 0L ; i < count ; i++) {
+      CURLcode result;
+      char *certp;
+      server_cert = (SecCertificateRef)CFArrayGetValueAtIndex(server_certs, i);
+      result = CopyCertSubject(data, server_cert, &certp);
+      if(!result) {
+        infof(data, "Server certificate: %s\n", certp);
+        free(certp);
+      }
+    }
+    CFRelease(server_certs);
+  }
+#endif /* CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS */
+}
+#endif /* !CURL_DISABLE_VERBOSE_STRINGS */
+
+static CURLcode
+sectransp_connect_step3(struct connectdata *conn,
+                        int sockindex)
+{
+  struct Curl_easy *data = conn->data;
+  struct ssl_connect_data *connssl = &conn->ssl[sockindex];
+
+  /* There is no step 3!
+   * Well, okay, if verbose mode is on, let's print the details of the
+   * server certificates. */
+#ifndef CURL_DISABLE_VERBOSE_STRINGS
+  if(data->set.verbose)
+    show_verbose_server_cert(conn, sockindex);
+#endif
+
+  connssl->connecting_state = ssl_connect_done;
+  return CURLE_OK;
+}
+
+static Curl_recv sectransp_recv;
+static Curl_send sectransp_send;
+
+static CURLcode
+sectransp_connect_common(struct connectdata *conn,
+                         int sockindex,
+                         bool nonblocking,
+                         bool *done)
+{
+  CURLcode result;
+  struct Curl_easy *data = conn->data;
+  struct ssl_connect_data *connssl = &conn->ssl[sockindex];
+  curl_socket_t sockfd = conn->sock[sockindex];
+  int what;
+
+  /* check if the connection has already been established */
+  if(ssl_connection_complete == connssl->state) {
+    *done = TRUE;
+    return CURLE_OK;
+  }
+
+  if(ssl_connect_1 == connssl->connecting_state) {
+    /* Find out how much more time we're allowed */
     const timediff_t timeout_ms = Curl_timeleft(data, NULL, TRUE);
- 
-    if(timeout_ms < 0) { 
-      /* no need to continue if time already is up */ 
-      failf(data, "SSL connection timeout"); 
-      return CURLE_OPERATION_TIMEDOUT; 
-    } 
- 
-    result = sectransp_connect_step1(conn, sockindex); 
-    if(result) 
-      return result; 
-  } 
- 
-  while(ssl_connect_2 == connssl->connecting_state || 
-        ssl_connect_2_reading == connssl->connecting_state || 
-        ssl_connect_2_writing == connssl->connecting_state) { 
- 
-    /* check allowed time left */ 
+
+    if(timeout_ms < 0) {
+      /* no need to continue if time already is up */
+      failf(data, "SSL connection timeout");
+      return CURLE_OPERATION_TIMEDOUT;
+    }
+
+    result = sectransp_connect_step1(conn, sockindex);
+    if(result)
+      return result;
+  }
+
+  while(ssl_connect_2 == connssl->connecting_state ||
+        ssl_connect_2_reading == connssl->connecting_state ||
+        ssl_connect_2_writing == connssl->connecting_state) {
+
+    /* check allowed time left */
     const timediff_t timeout_ms = Curl_timeleft(data, NULL, TRUE);
- 
-    if(timeout_ms < 0) { 
-      /* no need to continue if time already is up */ 
-      failf(data, "SSL connection timeout"); 
-      return CURLE_OPERATION_TIMEDOUT; 
-    } 
- 
-    /* if ssl is expecting something, check if it's available. */ 
-    if(connssl->connecting_state == ssl_connect_2_reading || 
-       connssl->connecting_state == ssl_connect_2_writing) { 
- 
-      curl_socket_t writefd = ssl_connect_2_writing == 
-      connssl->connecting_state?sockfd:CURL_SOCKET_BAD; 
-      curl_socket_t readfd = ssl_connect_2_reading == 
-      connssl->connecting_state?sockfd:CURL_SOCKET_BAD; 
- 
-      what = Curl_socket_check(readfd, CURL_SOCKET_BAD, writefd, 
+
+    if(timeout_ms < 0) {
+      /* no need to continue if time already is up */
+      failf(data, "SSL connection timeout");
+      return CURLE_OPERATION_TIMEDOUT;
+    }
+
+    /* if ssl is expecting something, check if it's available. */
+    if(connssl->connecting_state == ssl_connect_2_reading ||
+       connssl->connecting_state == ssl_connect_2_writing) {
+
+      curl_socket_t writefd = ssl_connect_2_writing ==
+      connssl->connecting_state?sockfd:CURL_SOCKET_BAD;
+      curl_socket_t readfd = ssl_connect_2_reading ==
+      connssl->connecting_state?sockfd:CURL_SOCKET_BAD;
+
+      what = Curl_socket_check(readfd, CURL_SOCKET_BAD, writefd,
                                nonblocking ? 0 : timeout_ms);
-      if(what < 0) { 
-        /* fatal error */ 
-        failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO); 
-        return CURLE_SSL_CONNECT_ERROR; 
-      } 
-      else if(0 == what) { 
-        if(nonblocking) { 
-          *done = FALSE; 
-          return CURLE_OK; 
-        } 
-        else { 
-          /* timeout */ 
-          failf(data, "SSL connection timeout"); 
-          return CURLE_OPERATION_TIMEDOUT; 
-        } 
-      } 
-      /* socket is readable or writable */ 
-    } 
- 
-    /* Run transaction, and return to the caller if it failed or if this 
-     * connection is done nonblocking and this loop would execute again. This 
-     * permits the owner of a multi handle to abort a connection attempt 
-     * before step2 has completed while ensuring that a client using select() 
-     * or epoll() will always have a valid fdset to wait on. 
-     */ 
-    result = sectransp_connect_step2(conn, sockindex); 
-    if(result || (nonblocking && 
-                  (ssl_connect_2 == connssl->connecting_state || 
-                   ssl_connect_2_reading == connssl->connecting_state || 
-                   ssl_connect_2_writing == connssl->connecting_state))) 
-      return result; 
- 
-  } /* repeat step2 until all transactions are done. */ 
- 
- 
-  if(ssl_connect_3 == connssl->connecting_state) { 
-    result = sectransp_connect_step3(conn, sockindex); 
-    if(result) 
-      return result; 
-  } 
- 
-  if(ssl_connect_done == connssl->connecting_state) { 
-    connssl->state = ssl_connection_complete; 
-    conn->recv[sockindex] = sectransp_recv; 
-    conn->send[sockindex] = sectransp_send; 
-    *done = TRUE; 
-  } 
-  else 
-    *done = FALSE; 
- 
-  /* Reset our connect state machine */ 
-  connssl->connecting_state = ssl_connect_1; 
- 
-  return CURLE_OK; 
-} 
- 
-static CURLcode Curl_sectransp_connect_nonblocking(struct connectdata *conn, 
-                                                   int sockindex, bool *done) 
-{ 
-  return sectransp_connect_common(conn, sockindex, TRUE, done); 
-} 
- 
-static CURLcode Curl_sectransp_connect(struct connectdata *conn, int sockindex) 
-{ 
-  CURLcode result; 
-  bool done = FALSE; 
- 
-  result = sectransp_connect_common(conn, sockindex, FALSE, &done); 
- 
-  if(result) 
-    return result; 
- 
-  DEBUGASSERT(done); 
- 
-  return CURLE_OK; 
-} 
- 
-static void Curl_sectransp_close(struct connectdata *conn, int sockindex) 
-{ 
-  struct ssl_connect_data *connssl = &conn->ssl[sockindex]; 
+      if(what < 0) {
+        /* fatal error */
+        failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO);
+        return CURLE_SSL_CONNECT_ERROR;
+      }
+      else if(0 == what) {
+        if(nonblocking) {
+          *done = FALSE;
+          return CURLE_OK;
+        }
+        else {
+          /* timeout */
+          failf(data, "SSL connection timeout");
+          return CURLE_OPERATION_TIMEDOUT;
+        }
+      }
+      /* socket is readable or writable */
+    }
+
+    /* Run transaction, and return to the caller if it failed or if this
+     * connection is done nonblocking and this loop would execute again. This
+     * permits the owner of a multi handle to abort a connection attempt
+     * before step2 has completed while ensuring that a client using select()
+     * or epoll() will always have a valid fdset to wait on.
+     */
+    result = sectransp_connect_step2(conn, sockindex);
+    if(result || (nonblocking &&
+                  (ssl_connect_2 == connssl->connecting_state ||
+                   ssl_connect_2_reading == connssl->connecting_state ||
+                   ssl_connect_2_writing == connssl->connecting_state)))
+      return result;
+
+  } /* repeat step2 until all transactions are done. */
+
+
+  if(ssl_connect_3 == connssl->connecting_state) {
+    result = sectransp_connect_step3(conn, sockindex);
+    if(result)
+      return result;
+  }
+
+  if(ssl_connect_done == connssl->connecting_state) {
+    connssl->state = ssl_connection_complete;
+    conn->recv[sockindex] = sectransp_recv;
+    conn->send[sockindex] = sectransp_send;
+    *done = TRUE;
+  }
+  else
+    *done = FALSE;
+
+  /* Reset our connect state machine */
+  connssl->connecting_state = ssl_connect_1;
+
+  return CURLE_OK;
+}
+
+static CURLcode Curl_sectransp_connect_nonblocking(struct connectdata *conn,
+                                                   int sockindex, bool *done)
+{
+  return sectransp_connect_common(conn, sockindex, TRUE, done);
+}
+
+static CURLcode Curl_sectransp_connect(struct connectdata *conn, int sockindex)
+{
+  CURLcode result;
+  bool done = FALSE;
+
+  result = sectransp_connect_common(conn, sockindex, FALSE, &done);
+
+  if(result)
+    return result;
+
+  DEBUGASSERT(done);
+
+  return CURLE_OK;
+}
+
+static void Curl_sectransp_close(struct connectdata *conn, int sockindex)
+{
+  struct ssl_connect_data *connssl = &conn->ssl[sockindex];
   struct ssl_backend_data *backend = connssl->backend;
- 
+
   if(backend->ssl_ctx) {
     (void)SSLClose(backend->ssl_ctx);
-#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS 
-    if(SSLCreateContext != NULL) 
+#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
+    if(SSLCreateContext != NULL)
       CFRelease(backend->ssl_ctx);
-#if CURL_SUPPORT_MAC_10_8 
-    else 
+#if CURL_SUPPORT_MAC_10_8
+    else
       (void)SSLDisposeContext(backend->ssl_ctx);
-#endif  /* CURL_SUPPORT_MAC_10_8 */ 
-#else 
+#endif  /* CURL_SUPPORT_MAC_10_8 */
+#else
     (void)SSLDisposeContext(backend->ssl_ctx);
-#endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */ 
+#endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */
     backend->ssl_ctx = NULL;
-  } 
+  }
   backend->ssl_sockfd = 0;
-} 
- 
-static int Curl_sectransp_shutdown(struct connectdata *conn, int sockindex) 
-{ 
-  struct ssl_connect_data *connssl = &conn->ssl[sockindex]; 
+}
+
+static int Curl_sectransp_shutdown(struct connectdata *conn, int sockindex)
+{
+  struct ssl_connect_data *connssl = &conn->ssl[sockindex];
   struct ssl_backend_data *backend = connssl->backend;
-  struct Curl_easy *data = conn->data; 
-  ssize_t nread; 
-  int what; 
-  int rc; 
-  char buf[120]; 
- 
+  struct Curl_easy *data = conn->data;
+  ssize_t nread;
+  int what;
+  int rc;
+  char buf[120];
+
   if(!backend->ssl_ctx)
-    return 0; 
- 
-#ifndef CURL_DISABLE_FTP 
-  if(data->set.ftp_ccc != CURLFTPSSL_CCC_ACTIVE) 
-    return 0; 
-#endif 
- 
-  Curl_sectransp_close(conn, sockindex); 
- 
-  rc = 0; 
- 
-  what = SOCKET_READABLE(conn->sock[sockindex], SSL_SHUTDOWN_TIMEOUT); 
- 
-  for(;;) { 
-    if(what < 0) { 
-      /* anything that gets here is fatally bad */ 
-      failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO); 
-      rc = -1; 
-      break; 
-    } 
- 
-    if(!what) {                                /* timeout */ 
-      failf(data, "SSL shutdown timeout"); 
-      break; 
-    } 
- 
-    /* Something to read, let's do it and hope that it is the close 
-     notify alert from the server. No way to SSL_Read now, so use read(). */ 
- 
-    nread = read(conn->sock[sockindex], buf, sizeof(buf)); 
- 
-    if(nread < 0) { 
-      failf(data, "read: %s", strerror(errno)); 
-      rc = -1; 
-    } 
- 
-    if(nread <= 0) 
-      break; 
- 
-    what = SOCKET_READABLE(conn->sock[sockindex], 0); 
-  } 
- 
-  return rc; 
-} 
- 
-static void Curl_sectransp_session_free(void *ptr) 
-{ 
-  /* ST, as of iOS 5 and Mountain Lion, has no public method of deleting a 
-     cached session ID inside the Security framework. There is a private 
-     function that does this, but I don't want to have to explain to you why I 
-     got your application rejected from the App Store due to the use of a 
-     private API, so the best we can do is free up our own char array that we 
-     created way back in sectransp_connect_step1... */ 
-  Curl_safefree(ptr); 
-} 
- 
-static size_t Curl_sectransp_version(char *buffer, size_t size) 
-{ 
-  return msnprintf(buffer, size, "SecureTransport"); 
-} 
- 
-/* 
- * This function uses SSLGetSessionState to determine connection status. 
- * 
- * Return codes: 
- *     1 means the connection is still in place 
- *     0 means the connection has been closed 
- *    -1 means the connection status is unknown 
- */ 
-static int Curl_sectransp_check_cxn(struct connectdata *conn) 
-{ 
-  struct ssl_connect_data *connssl = &conn->ssl[FIRSTSOCKET]; 
+    return 0;
+
+#ifndef CURL_DISABLE_FTP
+  if(data->set.ftp_ccc != CURLFTPSSL_CCC_ACTIVE)
+    return 0;
+#endif
+
+  Curl_sectransp_close(conn, sockindex);
+
+  rc = 0;
+
+  what = SOCKET_READABLE(conn->sock[sockindex], SSL_SHUTDOWN_TIMEOUT);
+
+  for(;;) {
+    if(what < 0) {
+      /* anything that gets here is fatally bad */
+      failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO);
+      rc = -1;
+      break;
+    }
+
+    if(!what) {                                /* timeout */
+      failf(data, "SSL shutdown timeout");
+      break;
+    }
+
+    /* Something to read, let's do it and hope that it is the close
+     notify alert from the server. No way to SSL_Read now, so use read(). */
+
+    nread = read(conn->sock[sockindex], buf, sizeof(buf));
+
+    if(nread < 0) {
+      failf(data, "read: %s", strerror(errno));
+      rc = -1;
+    }
+
+    if(nread <= 0)
+      break;
+
+    what = SOCKET_READABLE(conn->sock[sockindex], 0);
+  }
+
+  return rc;
+}
+
+static void Curl_sectransp_session_free(void *ptr)
+{
+  /* ST, as of iOS 5 and Mountain Lion, has no public method of deleting a
+     cached session ID inside the Security framework. There is a private
+     function that does this, but I don't want to have to explain to you why I
+     got your application rejected from the App Store due to the use of a
+     private API, so the best we can do is free up our own char array that we
+     created way back in sectransp_connect_step1... */
+  Curl_safefree(ptr);
+}
+
+static size_t Curl_sectransp_version(char *buffer, size_t size)
+{
+  return msnprintf(buffer, size, "SecureTransport");
+}
+
+/*
+ * This function uses SSLGetSessionState to determine connection status.
+ *
+ * Return codes:
+ *     1 means the connection is still in place
+ *     0 means the connection has been closed
+ *    -1 means the connection status is unknown
+ */
+static int Curl_sectransp_check_cxn(struct connectdata *conn)
+{
+  struct ssl_connect_data *connssl = &conn->ssl[FIRSTSOCKET];
   struct ssl_backend_data *backend = connssl->backend;
-  OSStatus err; 
-  SSLSessionState state; 
- 
+  OSStatus err;
+  SSLSessionState state;
+
   if(backend->ssl_ctx) {
     err = SSLGetSessionState(backend->ssl_ctx, &state);
-    if(err == noErr) 
-      return state == kSSLConnected || state == kSSLHandshake; 
-    return -1; 
-  } 
-  return 0; 
-} 
- 
-static bool Curl_sectransp_data_pending(const struct connectdata *conn, 
-                                        int connindex) 
-{ 
-  const struct ssl_connect_data *connssl = &conn->ssl[connindex]; 
+    if(err == noErr)
+      return state == kSSLConnected || state == kSSLHandshake;
+    return -1;
+  }
+  return 0;
+}
+
+static bool Curl_sectransp_data_pending(const struct connectdata *conn,
+                                        int connindex)
+{
+  const struct ssl_connect_data *connssl = &conn->ssl[connindex];
   struct ssl_backend_data *backend = connssl->backend;
-  OSStatus err; 
-  size_t buffer; 
- 
+  OSStatus err;
+  size_t buffer;
+
   if(backend->ssl_ctx) {  /* SSL is in use */
     err = SSLGetBufferedReadSize(backend->ssl_ctx, &buffer);
-    if(err == noErr) 
-      return buffer > 0UL; 
-    return false; 
-  } 
-  else 
-    return false; 
-} 
- 
-static CURLcode Curl_sectransp_random(struct Curl_easy *data UNUSED_PARAM, 
-                                      unsigned char *entropy, size_t length) 
-{ 
-  /* arc4random_buf() isn't available on cats older than Lion, so let's 
-     do this manually for the benefit of the older cats. */ 
-  size_t i; 
-  u_int32_t random_number = 0; 
- 
-  (void)data; 
- 
-  for(i = 0 ; i < length ; i++) { 
-    if(i % sizeof(u_int32_t) == 0) 
-      random_number = arc4random(); 
-    entropy[i] = random_number & 0xFF; 
-    random_number >>= 8; 
-  } 
-  i = random_number = 0; 
-  return CURLE_OK; 
-} 
- 
-static CURLcode Curl_sectransp_md5sum(unsigned char *tmp, /* input */ 
-                                      size_t tmplen, 
-                                      unsigned char *md5sum, /* output */ 
-                                      size_t md5len) 
-{ 
-  (void)md5len; 
-  (void)CC_MD5(tmp, (CC_LONG)tmplen, md5sum); 
-  return CURLE_OK; 
-} 
- 
-static CURLcode Curl_sectransp_sha256sum(const unsigned char *tmp, /* input */ 
-                                     size_t tmplen, 
-                                     unsigned char *sha256sum, /* output */ 
-                                     size_t sha256len) 
-{ 
-  assert(sha256len >= CURL_SHA256_DIGEST_LENGTH); 
-  (void)CC_SHA256(tmp, (CC_LONG)tmplen, sha256sum); 
-  return CURLE_OK; 
-} 
- 
-static bool Curl_sectransp_false_start(void) 
-{ 
-#if CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7 
-  if(SSLSetSessionOption != NULL) 
-    return TRUE; 
-#endif 
-  return FALSE; 
-} 
- 
-static ssize_t sectransp_send(struct connectdata *conn, 
-                              int sockindex, 
-                              const void *mem, 
-                              size_t len, 
-                              CURLcode *curlcode) 
-{ 
-  /*struct Curl_easy *data = conn->data;*/ 
-  struct ssl_connect_data *connssl = &conn->ssl[sockindex]; 
+    if(err == noErr)
+      return buffer > 0UL;
+    return false;
+  }
+  else
+    return false;
+}
+
+static CURLcode Curl_sectransp_random(struct Curl_easy *data UNUSED_PARAM,
+                                      unsigned char *entropy, size_t length)
+{
+  /* arc4random_buf() isn't available on cats older than Lion, so let's
+     do this manually for the benefit of the older cats. */
+  size_t i;
+  u_int32_t random_number = 0;
+
+  (void)data;
+
+  for(i = 0 ; i < length ; i++) {
+    if(i % sizeof(u_int32_t) == 0)
+      random_number = arc4random();
+    entropy[i] = random_number & 0xFF;
+    random_number >>= 8;
+  }
+  i = random_number = 0;
+  return CURLE_OK;
+}
+
+static CURLcode Curl_sectransp_md5sum(unsigned char *tmp, /* input */
+                                      size_t tmplen,
+                                      unsigned char *md5sum, /* output */
+                                      size_t md5len)
+{
+  (void)md5len;
+  (void)CC_MD5(tmp, (CC_LONG)tmplen, md5sum);
+  return CURLE_OK;
+}
+
+static CURLcode Curl_sectransp_sha256sum(const unsigned char *tmp, /* input */
+                                     size_t tmplen,
+                                     unsigned char *sha256sum, /* output */
+                                     size_t sha256len)
+{
+  assert(sha256len >= CURL_SHA256_DIGEST_LENGTH);
+  (void)CC_SHA256(tmp, (CC_LONG)tmplen, sha256sum);
+  return CURLE_OK;
+}
+
+static bool Curl_sectransp_false_start(void)
+{
+#if CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7
+  if(SSLSetSessionOption != NULL)
+    return TRUE;
+#endif
+  return FALSE;
+}
+
+static ssize_t sectransp_send(struct connectdata *conn,
+                              int sockindex,
+                              const void *mem,
+                              size_t len,
+                              CURLcode *curlcode)
+{
+  /*struct Curl_easy *data = conn->data;*/
+  struct ssl_connect_data *connssl = &conn->ssl[sockindex];
   struct ssl_backend_data *backend = connssl->backend;
-  size_t processed = 0UL; 
-  OSStatus err; 
- 
-  /* The SSLWrite() function works a little differently than expected. The 
-     fourth argument (processed) is currently documented in Apple's 
-     documentation as: "On return, the length, in bytes, of the data actually 
-     written." 
- 
-     Now, one could interpret that as "written to the socket," but actually, 
-     it returns the amount of data that was written to a buffer internal to 
-     the SSLContextRef instead. So it's possible for SSLWrite() to return 
-     errSSLWouldBlock and a number of bytes "written" because those bytes were 
-     encrypted and written to a buffer, not to the socket. 
- 
-     So if this happens, then we need to keep calling SSLWrite() over and 
-     over again with no new data until it quits returning errSSLWouldBlock. */ 
- 
-  /* Do we have buffered data to write from the last time we were called? */ 
+  size_t processed = 0UL;
+  OSStatus err;
+
+  /* The SSLWrite() function works a little differently than expected. The
+     fourth argument (processed) is currently documented in Apple's
+     documentation as: "On return, the length, in bytes, of the data actually
+     written."
+
+     Now, one could interpret that as "written to the socket," but actually,
+     it returns the amount of data that was written to a buffer internal to
+     the SSLContextRef instead. So it's possible for SSLWrite() to return
+     errSSLWouldBlock and a number of bytes "written" because those bytes were
+     encrypted and written to a buffer, not to the socket.
+
+     So if this happens, then we need to keep calling SSLWrite() over and
+     over again with no new data until it quits returning errSSLWouldBlock. */
+
+  /* Do we have buffered data to write from the last time we were called? */
   if(backend->ssl_write_buffered_length) {
-    /* Write the buffered data: */ 
+    /* Write the buffered data: */
     err = SSLWrite(backend->ssl_ctx, NULL, 0UL, &processed);
-    switch(err) { 
-      case noErr: 
-        /* processed is always going to be 0 because we didn't write to 
-           the buffer, so return how much was written to the socket */ 
+    switch(err) {
+      case noErr:
+        /* processed is always going to be 0 because we didn't write to
+           the buffer, so return how much was written to the socket */
         processed = backend->ssl_write_buffered_length;
         backend->ssl_write_buffered_length = 0UL;
-        break; 
-      case errSSLWouldBlock: /* argh, try again */ 
-        *curlcode = CURLE_AGAIN; 
-        return -1L; 
-      default: 
-        failf(conn->data, "SSLWrite() returned error %d", err); 
-        *curlcode = CURLE_SEND_ERROR; 
-        return -1L; 
-    } 
-  } 
-  else { 
-    /* We've got new data to write: */ 
+        break;
+      case errSSLWouldBlock: /* argh, try again */
+        *curlcode = CURLE_AGAIN;
+        return -1L;
+      default:
+        failf(conn->data, "SSLWrite() returned error %d", err);
+        *curlcode = CURLE_SEND_ERROR;
+        return -1L;
+    }
+  }
+  else {
+    /* We've got new data to write: */
     err = SSLWrite(backend->ssl_ctx, mem, len, &processed);
-    if(err != noErr) { 
-      switch(err) { 
-        case errSSLWouldBlock: 
-          /* Data was buffered but not sent, we have to tell the caller 
-             to try sending again, and remember how much was buffered */ 
+    if(err != noErr) {
+      switch(err) {
+        case errSSLWouldBlock:
+          /* Data was buffered but not sent, we have to tell the caller
+             to try sending again, and remember how much was buffered */
           backend->ssl_write_buffered_length = len;
-          *curlcode = CURLE_AGAIN; 
-          return -1L; 
-        default: 
-          failf(conn->data, "SSLWrite() returned error %d", err); 
-          *curlcode = CURLE_SEND_ERROR; 
-          return -1L; 
-      } 
-    } 
-  } 
-  return (ssize_t)processed; 
-} 
- 
-static ssize_t sectransp_recv(struct connectdata *conn, 
-                              int num, 
-                              char *buf, 
-                              size_t buffersize, 
-                              CURLcode *curlcode) 
-{ 
-  /*struct Curl_easy *data = conn->data;*/ 
-  struct ssl_connect_data *connssl = &conn->ssl[num]; 
+          *curlcode = CURLE_AGAIN;
+          return -1L;
+        default:
+          failf(conn->data, "SSLWrite() returned error %d", err);
+          *curlcode = CURLE_SEND_ERROR;
+          return -1L;
+      }
+    }
+  }
+  return (ssize_t)processed;
+}
+
+static ssize_t sectransp_recv(struct connectdata *conn,
+                              int num,
+                              char *buf,
+                              size_t buffersize,
+                              CURLcode *curlcode)
+{
+  /*struct Curl_easy *data = conn->data;*/
+  struct ssl_connect_data *connssl = &conn->ssl[num];
   struct ssl_backend_data *backend = connssl->backend;
-  size_t processed = 0UL; 
-  OSStatus err; 
- 
-  again: 
+  size_t processed = 0UL;
+  OSStatus err;
+
+  again:
   err = SSLRead(backend->ssl_ctx, buf, buffersize, &processed);
- 
-  if(err != noErr) { 
-    switch(err) { 
-      case errSSLWouldBlock:  /* return how much we read (if anything) */ 
-        if(processed) 
-          return (ssize_t)processed; 
-        *curlcode = CURLE_AGAIN; 
-        return -1L; 
-        break; 
- 
-      /* errSSLClosedGraceful - server gracefully shut down the SSL session 
-         errSSLClosedNoNotify - server hung up on us instead of sending a 
-           closure alert notice, read() is returning 0 
-         Either way, inform the caller that the server disconnected. */ 
-      case errSSLClosedGraceful: 
-      case errSSLClosedNoNotify: 
-        *curlcode = CURLE_OK; 
-        return -1L; 
-        break; 
- 
-        /* The below is errSSLPeerAuthCompleted; it's not defined in 
-           Leopard's headers */ 
-      case -9841: 
-        if(SSL_CONN_CONFIG(CAfile) && SSL_CONN_CONFIG(verifypeer)) { 
-          CURLcode result = verify_cert(SSL_CONN_CONFIG(CAfile), conn->data, 
+
+  if(err != noErr) {
+    switch(err) {
+      case errSSLWouldBlock:  /* return how much we read (if anything) */
+        if(processed)
+          return (ssize_t)processed;
+        *curlcode = CURLE_AGAIN;
+        return -1L;
+        break;
+
+      /* errSSLClosedGraceful - server gracefully shut down the SSL session
+         errSSLClosedNoNotify - server hung up on us instead of sending a
+           closure alert notice, read() is returning 0
+         Either way, inform the caller that the server disconnected. */
+      case errSSLClosedGraceful:
+      case errSSLClosedNoNotify:
+        *curlcode = CURLE_OK;
+        return -1L;
+        break;
+
+        /* The below is errSSLPeerAuthCompleted; it's not defined in
+           Leopard's headers */
+      case -9841:
+        if(SSL_CONN_CONFIG(CAfile) && SSL_CONN_CONFIG(verifypeer)) {
+          CURLcode result = verify_cert(SSL_CONN_CONFIG(CAfile), conn->data,
                                         backend->ssl_ctx);
-          if(result) 
-            return result; 
-        } 
-        goto again; 
-      default: 
-        failf(conn->data, "SSLRead() return error %d", err); 
-        *curlcode = CURLE_RECV_ERROR; 
-        return -1L; 
-        break; 
-    } 
-  } 
-  return (ssize_t)processed; 
-} 
- 
-static void *Curl_sectransp_get_internals(struct ssl_connect_data *connssl, 
-                                          CURLINFO info UNUSED_PARAM) 
-{ 
+          if(result)
+            return result;
+        }
+        goto again;
+      default:
+        failf(conn->data, "SSLRead() return error %d", err);
+        *curlcode = CURLE_RECV_ERROR;
+        return -1L;
+        break;
+    }
+  }
+  return (ssize_t)processed;
+}
+
+static void *Curl_sectransp_get_internals(struct ssl_connect_data *connssl,
+                                          CURLINFO info UNUSED_PARAM)
+{
   struct ssl_backend_data *backend = connssl->backend;
-  (void)info; 
+  (void)info;
   return backend->ssl_ctx;
-} 
- 
-const struct Curl_ssl Curl_ssl_sectransp = { 
-  { CURLSSLBACKEND_SECURETRANSPORT, "secure-transport" }, /* info */ 
- 
-#ifdef SECTRANSP_PINNEDPUBKEY 
-  SSLSUPP_PINNEDPUBKEY, 
-#else 
-  0, 
-#endif /* SECTRANSP_PINNEDPUBKEY */ 
- 
-  sizeof(struct ssl_backend_data), 
- 
-  Curl_none_init,                     /* init */ 
-  Curl_none_cleanup,                  /* cleanup */ 
-  Curl_sectransp_version,             /* version */ 
-  Curl_sectransp_check_cxn,           /* check_cxn */ 
-  Curl_sectransp_shutdown,            /* shutdown */ 
-  Curl_sectransp_data_pending,        /* data_pending */ 
-  Curl_sectransp_random,              /* random */ 
-  Curl_none_cert_status_request,      /* cert_status_request */ 
-  Curl_sectransp_connect,             /* connect */ 
-  Curl_sectransp_connect_nonblocking, /* connect_nonblocking */ 
-  Curl_sectransp_get_internals,       /* get_internals */ 
-  Curl_sectransp_close,               /* close_one */ 
-  Curl_none_close_all,                /* close_all */ 
-  Curl_sectransp_session_free,        /* session_free */ 
-  Curl_none_set_engine,               /* set_engine */ 
-  Curl_none_set_engine_default,       /* set_engine_default */ 
-  Curl_none_engines_list,             /* engines_list */ 
-  Curl_sectransp_false_start,         /* false_start */ 
-  Curl_sectransp_md5sum,              /* md5sum */ 
-  Curl_sectransp_sha256sum            /* sha256sum */ 
-}; 
- 
-#ifdef __clang__ 
-#pragma clang diagnostic pop 
-#endif 
- 
-#endif /* USE_SECTRANSP */ 
+}
+
+const struct Curl_ssl Curl_ssl_sectransp = {
+  { CURLSSLBACKEND_SECURETRANSPORT, "secure-transport" }, /* info */
+
+#ifdef SECTRANSP_PINNEDPUBKEY
+  SSLSUPP_PINNEDPUBKEY,
+#else
+  0,
+#endif /* SECTRANSP_PINNEDPUBKEY */
+
+  sizeof(struct ssl_backend_data),
+
+  Curl_none_init,                     /* init */
+  Curl_none_cleanup,                  /* cleanup */
+  Curl_sectransp_version,             /* version */
+  Curl_sectransp_check_cxn,           /* check_cxn */
+  Curl_sectransp_shutdown,            /* shutdown */
+  Curl_sectransp_data_pending,        /* data_pending */
+  Curl_sectransp_random,              /* random */
+  Curl_none_cert_status_request,      /* cert_status_request */
+  Curl_sectransp_connect,             /* connect */
+  Curl_sectransp_connect_nonblocking, /* connect_nonblocking */
+  Curl_sectransp_get_internals,       /* get_internals */
+  Curl_sectransp_close,               /* close_one */
+  Curl_none_close_all,                /* close_all */
+  Curl_sectransp_session_free,        /* session_free */
+  Curl_none_set_engine,               /* set_engine */
+  Curl_none_set_engine_default,       /* set_engine_default */
+  Curl_none_engines_list,             /* engines_list */
+  Curl_sectransp_false_start,         /* false_start */
+  Curl_sectransp_md5sum,              /* md5sum */
+  Curl_sectransp_sha256sum            /* sha256sum */
+};
+
+#ifdef __clang__
+#pragma clang diagnostic pop
+#endif
+
+#endif /* USE_SECTRANSP */
diff --git a/contrib/libs/curl/lib/vtls/sectransp.h b/contrib/libs/curl/lib/vtls/sectransp.h
index 1f0791b6cb..0febd6613a 100644
--- a/contrib/libs/curl/lib/vtls/sectransp.h
+++ b/contrib/libs/curl/lib/vtls/sectransp.h
@@ -1,32 +1,32 @@
-#ifndef HEADER_CURL_SECTRANSP_H 
-#define HEADER_CURL_SECTRANSP_H 
-/*************************************************************************** 
- *                                  _   _ ____  _ 
- *  Project                     ___| | | |  _ \| | 
- *                             / __| | | | |_) | | 
- *                            | (__| |_| |  _ <| |___ 
- *                             \___|\___/|_| \_\_____| 
- * 
- * Copyright (C) 2012 - 2014, Nick Zitzmann, <nickzman@gmail.com>. 
+#ifndef HEADER_CURL_SECTRANSP_H
+#define HEADER_CURL_SECTRANSP_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) 2012 - 2014, Nick Zitzmann, <nickzman@gmail.com>.
  * Copyright (C) 2012 - 2020, Daniel Stenberg, <daniel@haxx.se>, et al.
- * 
- * This software is licensed as described in the file COPYING, which 
- * you should have received as part of this distribution. The terms 
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
  * are also available at https://curl.se/docs/copyright.html.
- * 
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell 
- * copies of the Software, and permit persons to whom the Software is 
- * furnished to do so, under the terms of the COPYING file. 
- * 
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY 
- * KIND, either express or implied. 
- * 
- ***************************************************************************/ 
-#include "curl_setup.h" 
- 
-#ifdef USE_SECTRANSP 
- 
-extern const struct Curl_ssl Curl_ssl_sectransp; 
- 
-#endif /* USE_SECTRANSP */ 
-#endif /* HEADER_CURL_SECTRANSP_H */ 
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#ifdef USE_SECTRANSP
+
+extern const struct Curl_ssl Curl_ssl_sectransp;
+
+#endif /* USE_SECTRANSP */
+#endif /* HEADER_CURL_SECTRANSP_H */
diff --git a/contrib/libs/curl/lib/vtls/vtls.c b/contrib/libs/curl/lib/vtls/vtls.c
index 2da7d13736..3bd51fdaf2 100644
--- a/contrib/libs/curl/lib/vtls/vtls.c
+++ b/contrib/libs/curl/lib/vtls/vtls.c
@@ -306,7 +306,7 @@ Curl_ssl_connect(struct connectdata *conn, int sockindex)
   conn->ssl[sockindex].use = TRUE;
   conn->ssl[sockindex].state = ssl_connection_negotiating;
 
-  result = Curl_ssl->connect_blocking(conn, sockindex); 
+  result = Curl_ssl->connect_blocking(conn, sockindex);
 
   if(!result)
     Curl_pgrsTime(conn->data, TIMER_APPCONNECT); /* SSL is connected */
@@ -577,7 +577,7 @@ void Curl_ssl_close_all(struct Curl_easy *data)
 {
   /* kill the session ID cache if not shared */
   if(data->state.session && !SSLSESSION_SHARED(data)) {
-    size_t i; 
+    size_t i;
     for(i = 0; i < data->set.general_ssl.max_ssl_sessions; i++)
       /* the single-killer function handles empty table slots */
       Curl_ssl_kill_session(&data->state.session[i]);
@@ -592,7 +592,7 @@ void Curl_ssl_close_all(struct Curl_easy *data)
 #if defined(USE_OPENSSL) || defined(USE_GNUTLS) || defined(USE_SCHANNEL) || \
   defined(USE_SECTRANSP) || defined(USE_NSS) || \
   defined(USE_MBEDTLS) || defined(USE_WOLFSSL) || defined(USE_BEARSSL)
-int Curl_ssl_getsock(struct connectdata *conn, curl_socket_t *socks) 
+int Curl_ssl_getsock(struct connectdata *conn, curl_socket_t *socks)
 {
   struct ssl_connect_data *connssl = &conn->ssl[FIRSTSOCKET];
 
@@ -611,13 +611,13 @@ int Curl_ssl_getsock(struct connectdata *conn, curl_socket_t *socks)
 }
 #else
 int Curl_ssl_getsock(struct connectdata *conn,
-                     curl_socket_t *socks) 
+                     curl_socket_t *socks)
 {
   (void)conn;
   (void)socks;
   return GETSOCK_BLANK;
 }
-/* USE_OPENSSL || USE_GNUTLS || USE_SCHANNEL || USE_SECTRANSP || USE_NSS */ 
+/* USE_OPENSSL || USE_GNUTLS || USE_SCHANNEL || USE_SECTRANSP || USE_NSS */
 #endif
 
 void Curl_ssl_close(struct connectdata *conn, int sockindex)
@@ -629,7 +629,7 @@ void Curl_ssl_close(struct connectdata *conn, int sockindex)
 
 CURLcode Curl_ssl_shutdown(struct connectdata *conn, int sockindex)
 {
-  if(Curl_ssl->shut_down(conn, sockindex)) 
+  if(Curl_ssl->shut_down(conn, sockindex))
     return CURLE_SSL_SHUTDOWN_FAILED;
 
   conn->ssl[sockindex].use = FALSE; /* get back to ordinary socket usage */
@@ -720,7 +720,7 @@ void Curl_ssl_free_certinfo(struct Curl_easy *data)
 
   if(ci->num_of_certs) {
     /* free all individual lists used */
-    int i; 
+    int i;
     for(i = 0; i<ci->num_of_certs; i++) {
       curl_slist_free_all(ci->certinfo[i]);
       ci->certinfo[i] = NULL;
@@ -890,11 +890,11 @@ CURLcode Curl_pin_peer_pubkey(struct Curl_easy *data,
 
   /* only do this if pinnedpubkey starts with "sha256//", length 8 */
   if(strncmp(pinnedpubkey, "sha256//", 8) == 0) {
-    CURLcode encode; 
-    size_t encodedlen, pinkeylen; 
-    char *encoded, *pinkeycopy, *begin_pos, *end_pos; 
-    unsigned char *sha256sumdigest; 
- 
+    CURLcode encode;
+    size_t encodedlen, pinkeylen;
+    char *encoded, *pinkeycopy, *begin_pos, *end_pos;
+    unsigned char *sha256sumdigest;
+
     if(!Curl_ssl->sha256sum) {
       /* without sha256 support, this cannot match */
       return result;
@@ -965,10 +965,10 @@ CURLcode Curl_pin_peer_pubkey(struct Curl_easy *data,
     return result;
 
   do {
-    long filesize; 
-    size_t size, pem_len; 
-    CURLcode pem_read; 
- 
+    long filesize;
+    size_t size, pem_len;
+    CURLcode pem_read;
+
     /* Determine the file's size */
     if(fseek(fp, 0, SEEK_END))
       break;
@@ -1188,7 +1188,7 @@ static CURLcode Curl_multissl_connect(struct connectdata *conn, int sockindex)
 {
   if(multissl_init(NULL))
     return CURLE_FAILED_INIT;
-  return Curl_ssl->connect_blocking(conn, sockindex); 
+  return Curl_ssl->connect_blocking(conn, sockindex);
 }
 
 static CURLcode Curl_multissl_connect_nonblocking(struct connectdata *conn,
@@ -1244,10 +1244,10 @@ static const struct Curl_ssl Curl_ssl_multi = {
 const struct Curl_ssl *Curl_ssl =
 #if defined(CURL_WITH_MULTI_SSL)
   &Curl_ssl_multi;
-#elif defined(USE_WOLFSSL) 
-  &Curl_ssl_wolfssl; 
-#elif defined(USE_SECTRANSP) 
-  &Curl_ssl_sectransp; 
+#elif defined(USE_WOLFSSL)
+  &Curl_ssl_wolfssl;
+#elif defined(USE_SECTRANSP)
+  &Curl_ssl_sectransp;
 #elif defined(USE_GNUTLS)
   &Curl_ssl_gnutls;
 #elif defined(USE_GSKIT)
@@ -1269,11 +1269,11 @@ const struct Curl_ssl *Curl_ssl =
 #endif
 
 static const struct Curl_ssl *available_backends[] = {
-#if defined(USE_WOLFSSL) 
-  &Curl_ssl_wolfssl, 
+#if defined(USE_WOLFSSL)
+  &Curl_ssl_wolfssl,
 #endif
-#if defined(USE_SECTRANSP) 
-  &Curl_ssl_sectransp, 
+#if defined(USE_SECTRANSP)
+  &Curl_ssl_sectransp,
 #endif
 #if defined(USE_GNUTLS)
   &Curl_ssl_gnutls,
@@ -1313,7 +1313,7 @@ static size_t Curl_multissl_version(char *buffer, size_t size)
 
   if(current != selected) {
     char *p = backends;
-    char *end = backends + sizeof(backends); 
+    char *end = backends + sizeof(backends);
     int i;
 
     selected = current;
@@ -1368,7 +1368,7 @@ static int multissl_init(const struct Curl_ssl *backend)
     env = CURL_DEFAULT_SSL_BACKEND;
 #endif
   if(env) {
-    int i; 
+    int i;
     for(i = 0; available_backends[i]; i++) {
       if(strcasecompare(env, available_backends[i]->info.name)) {
         Curl_ssl = available_backends[i];
diff --git a/contrib/libs/curl/lib/vtls/vtls.h b/contrib/libs/curl/lib/vtls/vtls.h
index be8ded618c..f4cab9988f 100644
--- a/contrib/libs/curl/lib/vtls/vtls.h
+++ b/contrib/libs/curl/lib/vtls/vtls.h
@@ -47,7 +47,7 @@ struct Curl_ssl {
 
   size_t (*version)(char *buffer, size_t size);
   int (*check_cxn)(struct connectdata *cxn);
-  int (*shut_down)(struct connectdata *conn, int sockindex); 
+  int (*shut_down)(struct connectdata *conn, int sockindex);
   bool (*data_pending)(const struct connectdata *conn,
                        int connindex);
 
@@ -56,7 +56,7 @@ struct Curl_ssl {
                      size_t length);
   bool (*cert_status_request)(void);
 
-  CURLcode (*connect_blocking)(struct connectdata *conn, int sockindex); 
+  CURLcode (*connect_blocking)(struct connectdata *conn, int sockindex);
   CURLcode (*connect_nonblocking)(struct connectdata *conn, int sockindex,
                                   bool *done);
   void *(*get_internals)(struct ssl_connect_data *connssl, CURLINFO info);
@@ -102,9 +102,9 @@ CURLcode Curl_none_md5sum(unsigned char *input, size_t inputlen,
 #include "gtls.h"           /* GnuTLS versions */
 #include "nssg.h"           /* NSS versions */
 #include "gskit.h"          /* Global Secure ToolKit versions */
-#include "wolfssl.h"        /* wolfSSL versions */ 
+#include "wolfssl.h"        /* wolfSSL versions */
 #include "schannel.h"       /* Schannel SSPI version */
-#include "sectransp.h"      /* SecureTransport (Darwin) version */ 
+#include "sectransp.h"      /* SecureTransport (Darwin) version */
 #include "mbedtls.h"        /* mbedTLS versions */
 #include "mesalink.h"       /* MesaLink versions */
 #include "bearssl.h"        /* BearSSL versions */
@@ -158,7 +158,7 @@ bool Curl_ssl_config_matches(struct ssl_primary_config *data,
 bool Curl_clone_primary_ssl_config(struct ssl_primary_config *source,
                                    struct ssl_primary_config *dest);
 void Curl_free_primary_ssl_config(struct ssl_primary_config *sslc);
-int Curl_ssl_getsock(struct connectdata *conn, curl_socket_t *socks); 
+int Curl_ssl_getsock(struct connectdata *conn, curl_socket_t *socks);
 
 int Curl_ssl_backend(void);
 
diff --git a/contrib/libs/curl/lib/vtls/wolfssl.c b/contrib/libs/curl/lib/vtls/wolfssl.c
index 3627be345c..ac9818824d 100644
--- a/contrib/libs/curl/lib/vtls/wolfssl.c
+++ b/contrib/libs/curl/lib/vtls/wolfssl.c
@@ -1,105 +1,105 @@
-/*************************************************************************** 
- *                                  _   _ ____  _ 
- *  Project                     ___| | | |  _ \| | 
- *                             / __| | | | |_) | | 
- *                            | (__| |_| |  _ <| |___ 
- *                             \___|\___/|_| \_\_____| 
- * 
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
  * Copyright (C) 1998 - 2020, Daniel Stenberg, <daniel@haxx.se>, et al.
- * 
- * This software is licensed as described in the file COPYING, which 
- * you should have received as part of this distribution. The terms 
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
  * are also available at https://curl.se/docs/copyright.html.
- * 
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell 
- * copies of the Software, and permit persons to whom the Software is 
- * furnished to do so, under the terms of the COPYING file. 
- * 
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY 
- * KIND, either express or implied. 
- * 
- ***************************************************************************/ 
- 
-/* 
- * Source file for all wolfSSL specific code for the TLS/SSL layer. No code 
- * but vtls.c should ever call or use these functions. 
- * 
- */ 
- 
-#include "curl_setup.h" 
- 
-#ifdef USE_WOLFSSL 
- 
-#define WOLFSSL_OPTIONS_IGNORE_SYS 
-#error #include <wolfssl/version.h> 
-#error #include <wolfssl/options.h> 
- 
-/* To determine what functions are available we rely on one or both of: 
-   - the user's options.h generated by wolfSSL 
-   - the symbols detected by curl's configure 
-   Since they are markedly different from one another, and one or the other may 
-   not be available, we do some checking below to bring things in sync. */ 
- 
-/* HAVE_ALPN is wolfSSL's build time symbol for enabling ALPN in options.h. */ 
-#ifndef HAVE_ALPN 
-#ifdef HAVE_WOLFSSL_USEALPN 
-#define HAVE_ALPN 
-#endif 
-#endif 
- 
-/* WOLFSSL_ALLOW_SSLV3 is wolfSSL's build time symbol for enabling SSLv3 in 
-   options.h, but is only seen in >= 3.6.6 since that's when they started 
-   disabling SSLv3 by default. */ 
-#ifndef WOLFSSL_ALLOW_SSLV3 
-#if (LIBWOLFSSL_VERSION_HEX < 0x03006006) || \ 
-  defined(HAVE_WOLFSSLV3_CLIENT_METHOD) 
-#define WOLFSSL_ALLOW_SSLV3 
-#endif 
-#endif 
- 
-#include <limits.h> 
- 
-#include "urldata.h" 
-#include "sendf.h" 
-#include "inet_pton.h" 
-#include "vtls.h" 
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ ***************************************************************************/
+
+/*
+ * Source file for all wolfSSL specific code for the TLS/SSL layer. No code
+ * but vtls.c should ever call or use these functions.
+ *
+ */
+
+#include "curl_setup.h"
+
+#ifdef USE_WOLFSSL
+
+#define WOLFSSL_OPTIONS_IGNORE_SYS
+#error #include <wolfssl/version.h>
+#error #include <wolfssl/options.h>
+
+/* To determine what functions are available we rely on one or both of:
+   - the user's options.h generated by wolfSSL
+   - the symbols detected by curl's configure
+   Since they are markedly different from one another, and one or the other may
+   not be available, we do some checking below to bring things in sync. */
+
+/* HAVE_ALPN is wolfSSL's build time symbol for enabling ALPN in options.h. */
+#ifndef HAVE_ALPN
+#ifdef HAVE_WOLFSSL_USEALPN
+#define HAVE_ALPN
+#endif
+#endif
+
+/* WOLFSSL_ALLOW_SSLV3 is wolfSSL's build time symbol for enabling SSLv3 in
+   options.h, but is only seen in >= 3.6.6 since that's when they started
+   disabling SSLv3 by default. */
+#ifndef WOLFSSL_ALLOW_SSLV3
+#if (LIBWOLFSSL_VERSION_HEX < 0x03006006) || \
+  defined(HAVE_WOLFSSLV3_CLIENT_METHOD)
+#define WOLFSSL_ALLOW_SSLV3
+#endif
+#endif
+
+#include <limits.h>
+
+#include "urldata.h"
+#include "sendf.h"
+#include "inet_pton.h"
+#include "vtls.h"
 #include "keylog.h"
-#include "parsedate.h" 
-#include "connect.h" /* for the connect timeout */ 
-#include "select.h" 
-#include "strcase.h" 
-#include "x509asn1.h" 
-#include "curl_printf.h" 
-#include "multiif.h" 
- 
-#error #include <wolfssl/openssl/ssl.h> 
-#error #include <wolfssl/ssl.h> 
-#error #include <wolfssl/error-ssl.h> 
-#include "wolfssl.h" 
- 
-/* The last #include files should be: */ 
-#include "curl_memory.h" 
-#include "memdebug.h" 
- 
-/* KEEP_PEER_CERT is a product of the presence of build time symbol 
-   OPENSSL_EXTRA without NO_CERTS, depending on the version. KEEP_PEER_CERT is 
-   in wolfSSL's settings.h, and the latter two are build time symbols in 
-   options.h. */ 
-#ifndef KEEP_PEER_CERT 
-#if defined(HAVE_WOLFSSL_GET_PEER_CERTIFICATE) || \ 
-    (defined(OPENSSL_EXTRA) && !defined(NO_CERTS)) 
-#define KEEP_PEER_CERT 
-#endif 
-#endif 
- 
-struct ssl_backend_data { 
-  SSL_CTX* ctx; 
-  SSL*     handle; 
-}; 
- 
-static Curl_recv wolfssl_recv; 
-static Curl_send wolfssl_send; 
- 
+#include "parsedate.h"
+#include "connect.h" /* for the connect timeout */
+#include "select.h"
+#include "strcase.h"
+#include "x509asn1.h"
+#include "curl_printf.h"
+#include "multiif.h"
+
+#error #include <wolfssl/openssl/ssl.h>
+#error #include <wolfssl/ssl.h>
+#error #include <wolfssl/error-ssl.h>
+#include "wolfssl.h"
+
+/* The last #include files should be: */
+#include "curl_memory.h"
+#include "memdebug.h"
+
+/* KEEP_PEER_CERT is a product of the presence of build time symbol
+   OPENSSL_EXTRA without NO_CERTS, depending on the version. KEEP_PEER_CERT is
+   in wolfSSL's settings.h, and the latter two are build time symbols in
+   options.h. */
+#ifndef KEEP_PEER_CERT
+#if defined(HAVE_WOLFSSL_GET_PEER_CERTIFICATE) || \
+    (defined(OPENSSL_EXTRA) && !defined(NO_CERTS))
+#define KEEP_PEER_CERT
+#endif
+#endif
+
+struct ssl_backend_data {
+  SSL_CTX* ctx;
+  SSL*     handle;
+};
+
+static Curl_recv wolfssl_recv;
+static Curl_send wolfssl_send;
+
 #ifdef OPENSSL_EXTRA
 /*
  * Availability note:
@@ -118,7 +118,7 @@ wolfssl_tls13_secret_callback(SSL *ssl, int id, const unsigned char *secret,
   const char *label;
   unsigned char client_random[SSL3_RANDOM_SIZE];
   (void)ctx;
- 
+
   if(!ssl || !Curl_tls_keylog_enabled()) {
     return 0;
   }
@@ -201,294 +201,294 @@ wolfssl_log_tls12_secret(SSL *ssl)
 }
 #endif /* OPENSSL_EXTRA */
 
-static int do_file_type(const char *type) 
-{ 
-  if(!type || !type[0]) 
-    return SSL_FILETYPE_PEM; 
-  if(strcasecompare(type, "PEM")) 
-    return SSL_FILETYPE_PEM; 
-  if(strcasecompare(type, "DER")) 
-    return SSL_FILETYPE_ASN1; 
-  return -1; 
-} 
- 
-/* 
- * This function loads all the client/CA certificates and CRLs. Setup the TLS 
- * layer and do all necessary magic. 
- */ 
-static CURLcode 
-wolfssl_connect_step1(struct connectdata *conn, 
-                     int sockindex) 
-{ 
-  char *ciphers; 
-  struct Curl_easy *data = conn->data; 
+static int do_file_type(const char *type)
+{
+  if(!type || !type[0])
+    return SSL_FILETYPE_PEM;
+  if(strcasecompare(type, "PEM"))
+    return SSL_FILETYPE_PEM;
+  if(strcasecompare(type, "DER"))
+    return SSL_FILETYPE_ASN1;
+  return -1;
+}
+
+/*
+ * This function loads all the client/CA certificates and CRLs. Setup the TLS
+ * layer and do all necessary magic.
+ */
+static CURLcode
+wolfssl_connect_step1(struct connectdata *conn,
+                     int sockindex)
+{
+  char *ciphers;
+  struct Curl_easy *data = conn->data;
   struct ssl_connect_data *connssl = &conn->ssl[sockindex];
   struct ssl_backend_data *backend = connssl->backend;
-  SSL_METHOD* req_method = NULL; 
-  curl_socket_t sockfd = conn->sock[sockindex]; 
-#ifdef HAVE_SNI 
-  bool sni = FALSE; 
-#define use_sni(x)  sni = (x) 
-#else 
-#define use_sni(x)  Curl_nop_stmt 
-#endif 
- 
-  if(connssl->state == ssl_connection_complete) 
-    return CURLE_OK; 
- 
-  if(SSL_CONN_CONFIG(version_max) != CURL_SSLVERSION_MAX_NONE) { 
-    failf(data, "wolfSSL does not support to set maximum SSL/TLS version"); 
-    return CURLE_SSL_CONNECT_ERROR; 
-  } 
- 
-  /* check to see if we've been told to use an explicit SSL/TLS version */ 
-  switch(SSL_CONN_CONFIG(version)) { 
-  case CURL_SSLVERSION_DEFAULT: 
-  case CURL_SSLVERSION_TLSv1: 
-#if LIBWOLFSSL_VERSION_HEX >= 0x03003000 /* >= 3.3.0 */ 
-    /* minimum protocol version is set later after the CTX object is created */ 
-    req_method = SSLv23_client_method(); 
-#else 
-    infof(data, "wolfSSL <3.3.0 cannot be configured to use TLS 1.0-1.2, " 
-          "TLS 1.0 is used exclusively\n"); 
-    req_method = TLSv1_client_method(); 
-#endif 
-    use_sni(TRUE); 
-    break; 
-  case CURL_SSLVERSION_TLSv1_0: 
-#ifdef WOLFSSL_ALLOW_TLSV10 
-    req_method = TLSv1_client_method(); 
-    use_sni(TRUE); 
-#else 
-    failf(data, "wolfSSL does not support TLS 1.0"); 
-    return CURLE_NOT_BUILT_IN; 
-#endif 
-    break; 
-  case CURL_SSLVERSION_TLSv1_1: 
-    req_method = TLSv1_1_client_method(); 
-    use_sni(TRUE); 
-    break; 
-  case CURL_SSLVERSION_TLSv1_2: 
-    req_method = TLSv1_2_client_method(); 
-    use_sni(TRUE); 
-    break; 
-  case CURL_SSLVERSION_TLSv1_3: 
-#ifdef WOLFSSL_TLS13 
-    req_method = wolfTLSv1_3_client_method(); 
-    use_sni(TRUE); 
-    break; 
-#else 
-    failf(data, "wolfSSL: TLS 1.3 is not yet supported"); 
-    return CURLE_SSL_CONNECT_ERROR; 
-#endif 
-  case CURL_SSLVERSION_SSLv3: 
-#ifdef WOLFSSL_ALLOW_SSLV3 
-    req_method = SSLv3_client_method(); 
-    use_sni(FALSE); 
-#else 
-    failf(data, "wolfSSL does not support SSLv3"); 
-    return CURLE_NOT_BUILT_IN; 
-#endif 
-    break; 
-  case CURL_SSLVERSION_SSLv2: 
-    failf(data, "wolfSSL does not support SSLv2"); 
-    return CURLE_SSL_CONNECT_ERROR; 
-  default: 
-    failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION"); 
-    return CURLE_SSL_CONNECT_ERROR; 
-  } 
- 
-  if(!req_method) { 
-    failf(data, "SSL: couldn't create a method!"); 
-    return CURLE_OUT_OF_MEMORY; 
-  } 
- 
+  SSL_METHOD* req_method = NULL;
+  curl_socket_t sockfd = conn->sock[sockindex];
+#ifdef HAVE_SNI
+  bool sni = FALSE;
+#define use_sni(x)  sni = (x)
+#else
+#define use_sni(x)  Curl_nop_stmt
+#endif
+
+  if(connssl->state == ssl_connection_complete)
+    return CURLE_OK;
+
+  if(SSL_CONN_CONFIG(version_max) != CURL_SSLVERSION_MAX_NONE) {
+    failf(data, "wolfSSL does not support to set maximum SSL/TLS version");
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+
+  /* check to see if we've been told to use an explicit SSL/TLS version */
+  switch(SSL_CONN_CONFIG(version)) {
+  case CURL_SSLVERSION_DEFAULT:
+  case CURL_SSLVERSION_TLSv1:
+#if LIBWOLFSSL_VERSION_HEX >= 0x03003000 /* >= 3.3.0 */
+    /* minimum protocol version is set later after the CTX object is created */
+    req_method = SSLv23_client_method();
+#else
+    infof(data, "wolfSSL <3.3.0 cannot be configured to use TLS 1.0-1.2, "
+          "TLS 1.0 is used exclusively\n");
+    req_method = TLSv1_client_method();
+#endif
+    use_sni(TRUE);
+    break;
+  case CURL_SSLVERSION_TLSv1_0:
+#ifdef WOLFSSL_ALLOW_TLSV10
+    req_method = TLSv1_client_method();
+    use_sni(TRUE);
+#else
+    failf(data, "wolfSSL does not support TLS 1.0");
+    return CURLE_NOT_BUILT_IN;
+#endif
+    break;
+  case CURL_SSLVERSION_TLSv1_1:
+    req_method = TLSv1_1_client_method();
+    use_sni(TRUE);
+    break;
+  case CURL_SSLVERSION_TLSv1_2:
+    req_method = TLSv1_2_client_method();
+    use_sni(TRUE);
+    break;
+  case CURL_SSLVERSION_TLSv1_3:
+#ifdef WOLFSSL_TLS13
+    req_method = wolfTLSv1_3_client_method();
+    use_sni(TRUE);
+    break;
+#else
+    failf(data, "wolfSSL: TLS 1.3 is not yet supported");
+    return CURLE_SSL_CONNECT_ERROR;
+#endif
+  case CURL_SSLVERSION_SSLv3:
+#ifdef WOLFSSL_ALLOW_SSLV3
+    req_method = SSLv3_client_method();
+    use_sni(FALSE);
+#else
+    failf(data, "wolfSSL does not support SSLv3");
+    return CURLE_NOT_BUILT_IN;
+#endif
+    break;
+  case CURL_SSLVERSION_SSLv2:
+    failf(data, "wolfSSL does not support SSLv2");
+    return CURLE_SSL_CONNECT_ERROR;
+  default:
+    failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION");
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+
+  if(!req_method) {
+    failf(data, "SSL: couldn't create a method!");
+    return CURLE_OUT_OF_MEMORY;
+  }
+
   if(backend->ctx)
     SSL_CTX_free(backend->ctx);
   backend->ctx = SSL_CTX_new(req_method);
- 
+
   if(!backend->ctx) {
-    failf(data, "SSL: couldn't create a context!"); 
-    return CURLE_OUT_OF_MEMORY; 
-  } 
- 
-  switch(SSL_CONN_CONFIG(version)) { 
-  case CURL_SSLVERSION_DEFAULT: 
-  case CURL_SSLVERSION_TLSv1: 
-#if LIBWOLFSSL_VERSION_HEX > 0x03004006 /* > 3.4.6 */ 
-    /* Versions 3.3.0 to 3.4.6 we know the minimum protocol version is 
-     * whatever minimum version of TLS was built in and at least TLS 1.0. For 
-     * later library versions that could change (eg TLS 1.0 built in but 
-     * defaults to TLS 1.1) so we have this short circuit evaluation to find 
-     * the minimum supported TLS version. 
-    */ 
+    failf(data, "SSL: couldn't create a context!");
+    return CURLE_OUT_OF_MEMORY;
+  }
+
+  switch(SSL_CONN_CONFIG(version)) {
+  case CURL_SSLVERSION_DEFAULT:
+  case CURL_SSLVERSION_TLSv1:
+#if LIBWOLFSSL_VERSION_HEX > 0x03004006 /* > 3.4.6 */
+    /* Versions 3.3.0 to 3.4.6 we know the minimum protocol version is
+     * whatever minimum version of TLS was built in and at least TLS 1.0. For
+     * later library versions that could change (eg TLS 1.0 built in but
+     * defaults to TLS 1.1) so we have this short circuit evaluation to find
+     * the minimum supported TLS version.
+    */
     if((wolfSSL_CTX_SetMinVersion(backend->ctx, WOLFSSL_TLSV1) != 1) &&
        (wolfSSL_CTX_SetMinVersion(backend->ctx, WOLFSSL_TLSV1_1) != 1) &&
        (wolfSSL_CTX_SetMinVersion(backend->ctx, WOLFSSL_TLSV1_2) != 1)
-#ifdef WOLFSSL_TLS13 
+#ifdef WOLFSSL_TLS13
        && (wolfSSL_CTX_SetMinVersion(backend->ctx, WOLFSSL_TLSV1_3) != 1)
-#endif 
-      ) { 
-      failf(data, "SSL: couldn't set the minimum protocol version"); 
-      return CURLE_SSL_CONNECT_ERROR; 
-    } 
-#endif 
-    break; 
-  } 
- 
-  ciphers = SSL_CONN_CONFIG(cipher_list); 
-  if(ciphers) { 
+#endif
+      ) {
+      failf(data, "SSL: couldn't set the minimum protocol version");
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+#endif
+    break;
+  }
+
+  ciphers = SSL_CONN_CONFIG(cipher_list);
+  if(ciphers) {
     if(!SSL_CTX_set_cipher_list(backend->ctx, ciphers)) {
-      failf(data, "failed setting cipher list: %s", ciphers); 
-      return CURLE_SSL_CIPHER; 
-    } 
-    infof(data, "Cipher selection: %s\n", ciphers); 
-  } 
- 
-#ifndef NO_FILESYSTEM 
-  /* load trusted cacert */ 
-  if(SSL_CONN_CONFIG(CAfile)) { 
+      failf(data, "failed setting cipher list: %s", ciphers);
+      return CURLE_SSL_CIPHER;
+    }
+    infof(data, "Cipher selection: %s\n", ciphers);
+  }
+
+#ifndef NO_FILESYSTEM
+  /* load trusted cacert */
+  if(SSL_CONN_CONFIG(CAfile)) {
     if(1 != SSL_CTX_load_verify_locations(backend->ctx,
-                                      SSL_CONN_CONFIG(CAfile), 
-                                      SSL_CONN_CONFIG(CApath))) { 
-      if(SSL_CONN_CONFIG(verifypeer)) { 
-        /* Fail if we insist on successfully verifying the server. */ 
+                                      SSL_CONN_CONFIG(CAfile),
+                                      SSL_CONN_CONFIG(CApath))) {
+      if(SSL_CONN_CONFIG(verifypeer)) {
+        /* Fail if we insist on successfully verifying the server. */
         failf(data, "error setting certificate verify locations:"
               " CAfile: %s CApath: %s",
-              SSL_CONN_CONFIG(CAfile)? 
-              SSL_CONN_CONFIG(CAfile): "none", 
-              SSL_CONN_CONFIG(CApath)? 
-              SSL_CONN_CONFIG(CApath) : "none"); 
-        return CURLE_SSL_CACERT_BADFILE; 
-      } 
-      else { 
-        /* Just continue with a warning if no strict certificate 
-           verification is required. */ 
-        infof(data, "error setting certificate verify locations," 
-              " continuing anyway:\n"); 
-      } 
-    } 
-    else { 
-      /* Everything is fine. */ 
-      infof(data, "successfully set certificate verify locations:\n"); 
-    } 
+              SSL_CONN_CONFIG(CAfile)?
+              SSL_CONN_CONFIG(CAfile): "none",
+              SSL_CONN_CONFIG(CApath)?
+              SSL_CONN_CONFIG(CApath) : "none");
+        return CURLE_SSL_CACERT_BADFILE;
+      }
+      else {
+        /* Just continue with a warning if no strict certificate
+           verification is required. */
+        infof(data, "error setting certificate verify locations,"
+              " continuing anyway:\n");
+      }
+    }
+    else {
+      /* Everything is fine. */
+      infof(data, "successfully set certificate verify locations:\n");
+    }
     infof(data, " CAfile: %s\n",
           SSL_CONN_CONFIG(CAfile) ? SSL_CONN_CONFIG(CAfile) : "none");
     infof(data, " CApath: %s\n",
           SSL_CONN_CONFIG(CApath) ? SSL_CONN_CONFIG(CApath) : "none");
-  } 
- 
-  /* Load the client certificate, and private key */ 
+  }
+
+  /* Load the client certificate, and private key */
   if(SSL_SET_OPTION(primary.clientcert) && SSL_SET_OPTION(key)) {
-    int file_type = do_file_type(SSL_SET_OPTION(cert_type)); 
- 
+    int file_type = do_file_type(SSL_SET_OPTION(cert_type));
+
     if(SSL_CTX_use_certificate_file(backend->ctx,
                                     SSL_SET_OPTION(primary.clientcert),
                                     file_type) != 1) {
-      failf(data, "unable to use client certificate (no key or wrong pass" 
-            " phrase?)"); 
-      return CURLE_SSL_CONNECT_ERROR; 
-    } 
- 
-    file_type = do_file_type(SSL_SET_OPTION(key_type)); 
+      failf(data, "unable to use client certificate (no key or wrong pass"
+            " phrase?)");
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+
+    file_type = do_file_type(SSL_SET_OPTION(key_type));
     if(SSL_CTX_use_PrivateKey_file(backend->ctx, SSL_SET_OPTION(key),
-                                    file_type) != 1) { 
-      failf(data, "unable to set private key"); 
-      return CURLE_SSL_CONNECT_ERROR; 
-    } 
-  } 
-#endif /* !NO_FILESYSTEM */ 
- 
-  /* SSL always tries to verify the peer, this only says whether it should 
-   * fail to connect if the verification fails, or if it should continue 
-   * anyway. In the latter case the result of the verification is checked with 
-   * SSL_get_verify_result() below. */ 
+                                    file_type) != 1) {
+      failf(data, "unable to set private key");
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+  }
+#endif /* !NO_FILESYSTEM */
+
+  /* SSL always tries to verify the peer, this only says whether it should
+   * fail to connect if the verification fails, or if it should continue
+   * anyway. In the latter case the result of the verification is checked with
+   * SSL_get_verify_result() below. */
   SSL_CTX_set_verify(backend->ctx,
-                     SSL_CONN_CONFIG(verifypeer)?SSL_VERIFY_PEER: 
-                                                 SSL_VERIFY_NONE, 
-                     NULL); 
- 
-#ifdef HAVE_SNI 
-  if(sni) { 
-    struct in_addr addr4; 
-#ifdef ENABLE_IPV6 
-    struct in6_addr addr6; 
-#endif 
+                     SSL_CONN_CONFIG(verifypeer)?SSL_VERIFY_PEER:
+                                                 SSL_VERIFY_NONE,
+                     NULL);
+
+#ifdef HAVE_SNI
+  if(sni) {
+    struct in_addr addr4;
+#ifdef ENABLE_IPV6
+    struct in6_addr addr6;
+#endif
 #ifndef CURL_DISABLE_PROXY
-    const char * const hostname = SSL_IS_PROXY() ? conn->http_proxy.host.name : 
-      conn->host.name; 
+    const char * const hostname = SSL_IS_PROXY() ? conn->http_proxy.host.name :
+      conn->host.name;
 #else
     const char * const hostname = conn->host.name;
 #endif
-    size_t hostname_len = strlen(hostname); 
-    if((hostname_len < USHRT_MAX) && 
-       (0 == Curl_inet_pton(AF_INET, hostname, &addr4)) && 
-#ifdef ENABLE_IPV6 
-       (0 == Curl_inet_pton(AF_INET6, hostname, &addr6)) && 
-#endif 
+    size_t hostname_len = strlen(hostname);
+    if((hostname_len < USHRT_MAX) &&
+       (0 == Curl_inet_pton(AF_INET, hostname, &addr4)) &&
+#ifdef ENABLE_IPV6
+       (0 == Curl_inet_pton(AF_INET6, hostname, &addr6)) &&
+#endif
        (wolfSSL_CTX_UseSNI(backend->ctx, WOLFSSL_SNI_HOST_NAME, hostname,
-                          (unsigned short)hostname_len) != 1)) { 
-      infof(data, "WARNING: failed to configure server name indication (SNI) " 
-            "TLS extension\n"); 
-    } 
-  } 
-#endif 
- 
-  /* give application a chance to interfere with SSL set up. */ 
-  if(data->set.ssl.fsslctx) { 
+                          (unsigned short)hostname_len) != 1)) {
+      infof(data, "WARNING: failed to configure server name indication (SNI) "
+            "TLS extension\n");
+    }
+  }
+#endif
+
+  /* give application a chance to interfere with SSL set up. */
+  if(data->set.ssl.fsslctx) {
     CURLcode result = (*data->set.ssl.fsslctx)(data, backend->ctx,
-                                               data->set.ssl.fsslctxp); 
-    if(result) { 
-      failf(data, "error signaled by ssl ctx callback"); 
-      return result; 
-    } 
-  } 
-#ifdef NO_FILESYSTEM 
-  else if(SSL_CONN_CONFIG(verifypeer)) { 
-    failf(data, "SSL: Certificates can't be loaded because wolfSSL was built" 
-          " with \"no filesystem\". Either disable peer verification" 
-          " (insecure) or if you are building an application with libcurl you" 
-          " can load certificates via CURLOPT_SSL_CTX_FUNCTION."); 
-    return CURLE_SSL_CONNECT_ERROR; 
-  } 
-#endif 
- 
-  /* Let's make an SSL structure */ 
+                                               data->set.ssl.fsslctxp);
+    if(result) {
+      failf(data, "error signaled by ssl ctx callback");
+      return result;
+    }
+  }
+#ifdef NO_FILESYSTEM
+  else if(SSL_CONN_CONFIG(verifypeer)) {
+    failf(data, "SSL: Certificates can't be loaded because wolfSSL was built"
+          " with \"no filesystem\". Either disable peer verification"
+          " (insecure) or if you are building an application with libcurl you"
+          " can load certificates via CURLOPT_SSL_CTX_FUNCTION.");
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+#endif
+
+  /* Let's make an SSL structure */
   if(backend->handle)
     SSL_free(backend->handle);
   backend->handle = SSL_new(backend->ctx);
   if(!backend->handle) {
-    failf(data, "SSL: couldn't create a context (handle)!"); 
-    return CURLE_OUT_OF_MEMORY; 
-  } 
- 
-#ifdef HAVE_ALPN 
-  if(conn->bits.tls_enable_alpn) { 
-    char protocols[128]; 
-    *protocols = '\0'; 
- 
-    /* wolfSSL's ALPN protocol name list format is a comma separated string of 
-       protocols in descending order of preference, eg: "h2,http/1.1" */ 
- 
-#ifdef USE_NGHTTP2 
-    if(data->set.httpversion >= CURL_HTTP_VERSION_2) { 
-      strcpy(protocols + strlen(protocols), NGHTTP2_PROTO_VERSION_ID ","); 
-      infof(data, "ALPN, offering %s\n", NGHTTP2_PROTO_VERSION_ID); 
-    } 
-#endif 
- 
-    strcpy(protocols + strlen(protocols), ALPN_HTTP_1_1); 
-    infof(data, "ALPN, offering %s\n", ALPN_HTTP_1_1); 
- 
+    failf(data, "SSL: couldn't create a context (handle)!");
+    return CURLE_OUT_OF_MEMORY;
+  }
+
+#ifdef HAVE_ALPN
+  if(conn->bits.tls_enable_alpn) {
+    char protocols[128];
+    *protocols = '\0';
+
+    /* wolfSSL's ALPN protocol name list format is a comma separated string of
+       protocols in descending order of preference, eg: "h2,http/1.1" */
+
+#ifdef USE_NGHTTP2
+    if(data->set.httpversion >= CURL_HTTP_VERSION_2) {
+      strcpy(protocols + strlen(protocols), NGHTTP2_PROTO_VERSION_ID ",");
+      infof(data, "ALPN, offering %s\n", NGHTTP2_PROTO_VERSION_ID);
+    }
+#endif
+
+    strcpy(protocols + strlen(protocols), ALPN_HTTP_1_1);
+    infof(data, "ALPN, offering %s\n", ALPN_HTTP_1_1);
+
     if(wolfSSL_UseALPN(backend->handle, protocols,
-                       (unsigned)strlen(protocols), 
-                       WOLFSSL_ALPN_CONTINUE_ON_MISMATCH) != SSL_SUCCESS) { 
-      failf(data, "SSL: failed setting ALPN protocols"); 
-      return CURLE_SSL_CONNECT_ERROR; 
-    } 
-  } 
-#endif /* HAVE_ALPN */ 
- 
+                       (unsigned)strlen(protocols),
+                       WOLFSSL_ALPN_CONTINUE_ON_MISMATCH) != SSL_SUCCESS) {
+      failf(data, "SSL: failed setting ALPN protocols");
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+  }
+#endif /* HAVE_ALPN */
+
 #ifdef OPENSSL_EXTRA
   if(Curl_tls_keylog_enabled()) {
     /* Ensure the Client Random is preserved. */
@@ -500,52 +500,52 @@ wolfssl_connect_step1(struct connectdata *conn,
   }
 #endif /* OPENSSL_EXTRA */
 
-  /* Check if there's a cached ID we can/should use here! */ 
-  if(SSL_SET_OPTION(primary.sessionid)) { 
-    void *ssl_sessionid = NULL; 
- 
-    Curl_ssl_sessionid_lock(conn); 
-    if(!Curl_ssl_getsessionid(conn, &ssl_sessionid, NULL, sockindex)) { 
-      /* we got a session id, use it! */ 
+  /* Check if there's a cached ID we can/should use here! */
+  if(SSL_SET_OPTION(primary.sessionid)) {
+    void *ssl_sessionid = NULL;
+
+    Curl_ssl_sessionid_lock(conn);
+    if(!Curl_ssl_getsessionid(conn, &ssl_sessionid, NULL, sockindex)) {
+      /* we got a session id, use it! */
       if(!SSL_set_session(backend->handle, ssl_sessionid)) {
-        char error_buffer[WOLFSSL_MAX_ERROR_SZ]; 
-        Curl_ssl_sessionid_unlock(conn); 
-        failf(data, "SSL: SSL_set_session failed: %s", 
+        char error_buffer[WOLFSSL_MAX_ERROR_SZ];
+        Curl_ssl_sessionid_unlock(conn);
+        failf(data, "SSL: SSL_set_session failed: %s",
               ERR_error_string(SSL_get_error(backend->handle, 0),
-                               error_buffer)); 
-        return CURLE_SSL_CONNECT_ERROR; 
-      } 
-      /* Informational message */ 
-      infof(data, "SSL re-using session ID\n"); 
-    } 
-    Curl_ssl_sessionid_unlock(conn); 
-  } 
- 
-  /* pass the raw socket into the SSL layer */ 
+                               error_buffer));
+        return CURLE_SSL_CONNECT_ERROR;
+      }
+      /* Informational message */
+      infof(data, "SSL re-using session ID\n");
+    }
+    Curl_ssl_sessionid_unlock(conn);
+  }
+
+  /* pass the raw socket into the SSL layer */
   if(!SSL_set_fd(backend->handle, (int)sockfd)) {
-    failf(data, "SSL: SSL_set_fd failed"); 
-    return CURLE_SSL_CONNECT_ERROR; 
-  } 
- 
-  connssl->connecting_state = ssl_connect_2; 
-  return CURLE_OK; 
-} 
- 
- 
-static CURLcode 
-wolfssl_connect_step2(struct connectdata *conn, 
-                     int sockindex) 
-{ 
-  int ret = -1; 
-  struct Curl_easy *data = conn->data; 
+    failf(data, "SSL: SSL_set_fd failed");
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+
+  connssl->connecting_state = ssl_connect_2;
+  return CURLE_OK;
+}
+
+
+static CURLcode
+wolfssl_connect_step2(struct connectdata *conn,
+                     int sockindex)
+{
+  int ret = -1;
+  struct Curl_easy *data = conn->data;
   struct ssl_connect_data *connssl = &conn->ssl[sockindex];
   struct ssl_backend_data *backend = connssl->backend;
 #ifndef CURL_DISABLE_PROXY
-  const char * const hostname = SSL_IS_PROXY() ? conn->http_proxy.host.name : 
-    conn->host.name; 
-  const char * const dispname = SSL_IS_PROXY() ? 
-    conn->http_proxy.host.dispname : conn->host.dispname; 
-  const char * const pinnedpubkey = SSL_IS_PROXY() ? 
+  const char * const hostname = SSL_IS_PROXY() ? conn->http_proxy.host.name :
+    conn->host.name;
+  const char * const dispname = SSL_IS_PROXY() ?
+    conn->http_proxy.host.dispname : conn->host.dispname;
+  const char * const pinnedpubkey = SSL_IS_PROXY() ?
     data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY] :
     data->set.str[STRING_SSL_PINNEDPUBLICKEY_ORIG];
 #else
@@ -554,17 +554,17 @@ wolfssl_connect_step2(struct connectdata *conn,
   const char * const pinnedpubkey =
     data->set.str[STRING_SSL_PINNEDPUBLICKEY_ORIG];
 #endif
- 
-  conn->recv[sockindex] = wolfssl_recv; 
-  conn->send[sockindex] = wolfssl_send; 
- 
-  /* Enable RFC2818 checks */ 
-  if(SSL_CONN_CONFIG(verifyhost)) { 
+
+  conn->recv[sockindex] = wolfssl_recv;
+  conn->send[sockindex] = wolfssl_send;
+
+  /* Enable RFC2818 checks */
+  if(SSL_CONN_CONFIG(verifyhost)) {
     ret = wolfSSL_check_domain_name(backend->handle, hostname);
-    if(ret == SSL_FAILURE) 
-      return CURLE_OUT_OF_MEMORY; 
-  } 
- 
+    if(ret == SSL_FAILURE)
+      return CURLE_OUT_OF_MEMORY;
+  }
+
   ret = SSL_connect(backend->handle);
 
 #ifdef OPENSSL_EXTRA
@@ -591,559 +591,559 @@ wolfssl_connect_step2(struct connectdata *conn,
   }
 #endif  /* OPENSSL_EXTRA */
 
-  if(ret != 1) { 
-    char error_buffer[WOLFSSL_MAX_ERROR_SZ]; 
+  if(ret != 1) {
+    char error_buffer[WOLFSSL_MAX_ERROR_SZ];
     int  detail = SSL_get_error(backend->handle, ret);
- 
-    if(SSL_ERROR_WANT_READ == detail) { 
-      connssl->connecting_state = ssl_connect_2_reading; 
-      return CURLE_OK; 
-    } 
-    else if(SSL_ERROR_WANT_WRITE == detail) { 
-      connssl->connecting_state = ssl_connect_2_writing; 
-      return CURLE_OK; 
-    } 
-    /* There is no easy way to override only the CN matching. 
-     * This will enable the override of both mismatching SubjectAltNames 
-     * as also mismatching CN fields */ 
-    else if(DOMAIN_NAME_MISMATCH == detail) { 
-#if 1 
-      failf(data, "\tsubject alt name(s) or common name do not match \"%s\"\n", 
-            dispname); 
-      return CURLE_PEER_FAILED_VERIFICATION; 
-#else 
-      /* When the wolfssl_check_domain_name() is used and you desire to 
-       * continue on a DOMAIN_NAME_MISMATCH, i.e. 'conn->ssl_config.verifyhost 
-       * == 0', CyaSSL version 2.4.0 will fail with an INCOMPLETE_DATA 
-       * error. The only way to do this is currently to switch the 
-       * Wolfssl_check_domain_name() in and out based on the 
-       * 'conn->ssl_config.verifyhost' value. */ 
-      if(SSL_CONN_CONFIG(verifyhost)) { 
-        failf(data, 
-              "\tsubject alt name(s) or common name do not match \"%s\"\n", 
-              dispname); 
-        return CURLE_PEER_FAILED_VERIFICATION; 
-      } 
-      else { 
-        infof(data, 
-              "\tsubject alt name(s) and/or common name do not match \"%s\"\n", 
-              dispname); 
-        return CURLE_OK; 
-      } 
-#endif 
-    } 
-#if LIBWOLFSSL_VERSION_HEX >= 0x02007000 /* 2.7.0 */ 
-    else if(ASN_NO_SIGNER_E == detail) { 
-      if(SSL_CONN_CONFIG(verifypeer)) { 
-        failf(data, "\tCA signer not available for verification\n"); 
-        return CURLE_SSL_CACERT_BADFILE; 
-      } 
-      else { 
-        /* Just continue with a warning if no strict certificate 
-           verification is required. */ 
-        infof(data, "CA signer not available for verification, " 
-                    "continuing anyway\n"); 
-      } 
-    } 
-#endif 
-    else { 
-      failf(data, "SSL_connect failed with error %d: %s", detail, 
-          ERR_error_string(detail, error_buffer)); 
-      return CURLE_SSL_CONNECT_ERROR; 
-    } 
-  } 
- 
-  if(pinnedpubkey) { 
-#ifdef KEEP_PEER_CERT 
-    X509 *x509; 
-    const char *x509_der; 
-    int x509_der_len; 
+
+    if(SSL_ERROR_WANT_READ == detail) {
+      connssl->connecting_state = ssl_connect_2_reading;
+      return CURLE_OK;
+    }
+    else if(SSL_ERROR_WANT_WRITE == detail) {
+      connssl->connecting_state = ssl_connect_2_writing;
+      return CURLE_OK;
+    }
+    /* There is no easy way to override only the CN matching.
+     * This will enable the override of both mismatching SubjectAltNames
+     * as also mismatching CN fields */
+    else if(DOMAIN_NAME_MISMATCH == detail) {
+#if 1
+      failf(data, "\tsubject alt name(s) or common name do not match \"%s\"\n",
+            dispname);
+      return CURLE_PEER_FAILED_VERIFICATION;
+#else
+      /* When the wolfssl_check_domain_name() is used and you desire to
+       * continue on a DOMAIN_NAME_MISMATCH, i.e. 'conn->ssl_config.verifyhost
+       * == 0', CyaSSL version 2.4.0 will fail with an INCOMPLETE_DATA
+       * error. The only way to do this is currently to switch the
+       * Wolfssl_check_domain_name() in and out based on the
+       * 'conn->ssl_config.verifyhost' value. */
+      if(SSL_CONN_CONFIG(verifyhost)) {
+        failf(data,
+              "\tsubject alt name(s) or common name do not match \"%s\"\n",
+              dispname);
+        return CURLE_PEER_FAILED_VERIFICATION;
+      }
+      else {
+        infof(data,
+              "\tsubject alt name(s) and/or common name do not match \"%s\"\n",
+              dispname);
+        return CURLE_OK;
+      }
+#endif
+    }
+#if LIBWOLFSSL_VERSION_HEX >= 0x02007000 /* 2.7.0 */
+    else if(ASN_NO_SIGNER_E == detail) {
+      if(SSL_CONN_CONFIG(verifypeer)) {
+        failf(data, "\tCA signer not available for verification\n");
+        return CURLE_SSL_CACERT_BADFILE;
+      }
+      else {
+        /* Just continue with a warning if no strict certificate
+           verification is required. */
+        infof(data, "CA signer not available for verification, "
+                    "continuing anyway\n");
+      }
+    }
+#endif
+    else {
+      failf(data, "SSL_connect failed with error %d: %s", detail,
+          ERR_error_string(detail, error_buffer));
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+  }
+
+  if(pinnedpubkey) {
+#ifdef KEEP_PEER_CERT
+    X509 *x509;
+    const char *x509_der;
+    int x509_der_len;
     struct Curl_X509certificate x509_parsed;
     struct Curl_asn1Element *pubkey;
-    CURLcode result; 
- 
+    CURLcode result;
+
     x509 = SSL_get_peer_certificate(backend->handle);
-    if(!x509) { 
-      failf(data, "SSL: failed retrieving server certificate"); 
-      return CURLE_SSL_PINNEDPUBKEYNOTMATCH; 
-    } 
- 
-    x509_der = (const char *)wolfSSL_X509_get_der(x509, &x509_der_len); 
-    if(!x509_der) { 
-      failf(data, "SSL: failed retrieving ASN.1 server certificate"); 
-      return CURLE_SSL_PINNEDPUBKEYNOTMATCH; 
-    } 
- 
-    memset(&x509_parsed, 0, sizeof(x509_parsed)); 
-    if(Curl_parseX509(&x509_parsed, x509_der, x509_der + x509_der_len)) 
-      return CURLE_SSL_PINNEDPUBKEYNOTMATCH; 
- 
-    pubkey = &x509_parsed.subjectPublicKeyInfo; 
-    if(!pubkey->header || pubkey->end <= pubkey->header) { 
-      failf(data, "SSL: failed retrieving public key from server certificate"); 
-      return CURLE_SSL_PINNEDPUBKEYNOTMATCH; 
-    } 
- 
-    result = Curl_pin_peer_pubkey(data, 
-                                  pinnedpubkey, 
-                                  (const unsigned char *)pubkey->header, 
-                                  (size_t)(pubkey->end - pubkey->header)); 
-    if(result) { 
-      failf(data, "SSL: public key does not match pinned public key!"); 
-      return result; 
-    } 
-#else 
-    failf(data, "Library lacks pinning support built-in"); 
-    return CURLE_NOT_BUILT_IN; 
-#endif 
-  } 
- 
-#ifdef HAVE_ALPN 
-  if(conn->bits.tls_enable_alpn) { 
-    int rc; 
-    char *protocol = NULL; 
-    unsigned short protocol_len = 0; 
- 
+    if(!x509) {
+      failf(data, "SSL: failed retrieving server certificate");
+      return CURLE_SSL_PINNEDPUBKEYNOTMATCH;
+    }
+
+    x509_der = (const char *)wolfSSL_X509_get_der(x509, &x509_der_len);
+    if(!x509_der) {
+      failf(data, "SSL: failed retrieving ASN.1 server certificate");
+      return CURLE_SSL_PINNEDPUBKEYNOTMATCH;
+    }
+
+    memset(&x509_parsed, 0, sizeof(x509_parsed));
+    if(Curl_parseX509(&x509_parsed, x509_der, x509_der + x509_der_len))
+      return CURLE_SSL_PINNEDPUBKEYNOTMATCH;
+
+    pubkey = &x509_parsed.subjectPublicKeyInfo;
+    if(!pubkey->header || pubkey->end <= pubkey->header) {
+      failf(data, "SSL: failed retrieving public key from server certificate");
+      return CURLE_SSL_PINNEDPUBKEYNOTMATCH;
+    }
+
+    result = Curl_pin_peer_pubkey(data,
+                                  pinnedpubkey,
+                                  (const unsigned char *)pubkey->header,
+                                  (size_t)(pubkey->end - pubkey->header));
+    if(result) {
+      failf(data, "SSL: public key does not match pinned public key!");
+      return result;
+    }
+#else
+    failf(data, "Library lacks pinning support built-in");
+    return CURLE_NOT_BUILT_IN;
+#endif
+  }
+
+#ifdef HAVE_ALPN
+  if(conn->bits.tls_enable_alpn) {
+    int rc;
+    char *protocol = NULL;
+    unsigned short protocol_len = 0;
+
     rc = wolfSSL_ALPN_GetProtocol(backend->handle, &protocol, &protocol_len);
- 
-    if(rc == SSL_SUCCESS) { 
-      infof(data, "ALPN, server accepted to use %.*s\n", protocol_len, 
-            protocol); 
- 
-      if(protocol_len == ALPN_HTTP_1_1_LENGTH && 
-         !memcmp(protocol, ALPN_HTTP_1_1, ALPN_HTTP_1_1_LENGTH)) 
-        conn->negnpn = CURL_HTTP_VERSION_1_1; 
-#ifdef USE_NGHTTP2 
-      else if(data->set.httpversion >= CURL_HTTP_VERSION_2 && 
-              protocol_len == NGHTTP2_PROTO_VERSION_ID_LEN && 
-              !memcmp(protocol, NGHTTP2_PROTO_VERSION_ID, 
-                      NGHTTP2_PROTO_VERSION_ID_LEN)) 
-        conn->negnpn = CURL_HTTP_VERSION_2; 
-#endif 
-      else 
-        infof(data, "ALPN, unrecognized protocol %.*s\n", protocol_len, 
-              protocol); 
-      Curl_multiuse_state(conn, conn->negnpn == CURL_HTTP_VERSION_2 ? 
-                          BUNDLE_MULTIPLEX : BUNDLE_NO_MULTIUSE); 
-    } 
-    else if(rc == SSL_ALPN_NOT_FOUND) 
-      infof(data, "ALPN, server did not agree to a protocol\n"); 
-    else { 
-      failf(data, "ALPN, failure getting protocol, error %d", rc); 
-      return CURLE_SSL_CONNECT_ERROR; 
-    } 
-  } 
-#endif /* HAVE_ALPN */ 
- 
-  connssl->connecting_state = ssl_connect_3; 
-#if (LIBWOLFSSL_VERSION_HEX >= 0x03009010) 
-  infof(data, "SSL connection using %s / %s\n", 
+
+    if(rc == SSL_SUCCESS) {
+      infof(data, "ALPN, server accepted to use %.*s\n", protocol_len,
+            protocol);
+
+      if(protocol_len == ALPN_HTTP_1_1_LENGTH &&
+         !memcmp(protocol, ALPN_HTTP_1_1, ALPN_HTTP_1_1_LENGTH))
+        conn->negnpn = CURL_HTTP_VERSION_1_1;
+#ifdef USE_NGHTTP2
+      else if(data->set.httpversion >= CURL_HTTP_VERSION_2 &&
+              protocol_len == NGHTTP2_PROTO_VERSION_ID_LEN &&
+              !memcmp(protocol, NGHTTP2_PROTO_VERSION_ID,
+                      NGHTTP2_PROTO_VERSION_ID_LEN))
+        conn->negnpn = CURL_HTTP_VERSION_2;
+#endif
+      else
+        infof(data, "ALPN, unrecognized protocol %.*s\n", protocol_len,
+              protocol);
+      Curl_multiuse_state(conn, conn->negnpn == CURL_HTTP_VERSION_2 ?
+                          BUNDLE_MULTIPLEX : BUNDLE_NO_MULTIUSE);
+    }
+    else if(rc == SSL_ALPN_NOT_FOUND)
+      infof(data, "ALPN, server did not agree to a protocol\n");
+    else {
+      failf(data, "ALPN, failure getting protocol, error %d", rc);
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+  }
+#endif /* HAVE_ALPN */
+
+  connssl->connecting_state = ssl_connect_3;
+#if (LIBWOLFSSL_VERSION_HEX >= 0x03009010)
+  infof(data, "SSL connection using %s / %s\n",
         wolfSSL_get_version(backend->handle),
         wolfSSL_get_cipher_name(backend->handle));
-#else 
-  infof(data, "SSL connected\n"); 
-#endif 
- 
-  return CURLE_OK; 
-} 
- 
- 
-static CURLcode 
-wolfssl_connect_step3(struct connectdata *conn, 
-                     int sockindex) 
-{ 
-  CURLcode result = CURLE_OK; 
-  struct Curl_easy *data = conn->data; 
-  struct ssl_connect_data *connssl = &conn->ssl[sockindex]; 
+#else
+  infof(data, "SSL connected\n");
+#endif
+
+  return CURLE_OK;
+}
+
+
+static CURLcode
+wolfssl_connect_step3(struct connectdata *conn,
+                     int sockindex)
+{
+  CURLcode result = CURLE_OK;
+  struct Curl_easy *data = conn->data;
+  struct ssl_connect_data *connssl = &conn->ssl[sockindex];
   struct ssl_backend_data *backend = connssl->backend;
- 
-  DEBUGASSERT(ssl_connect_3 == connssl->connecting_state); 
- 
-  if(SSL_SET_OPTION(primary.sessionid)) { 
-    bool incache; 
-    SSL_SESSION *our_ssl_sessionid; 
-    void *old_ssl_sessionid = NULL; 
- 
+
+  DEBUGASSERT(ssl_connect_3 == connssl->connecting_state);
+
+  if(SSL_SET_OPTION(primary.sessionid)) {
+    bool incache;
+    SSL_SESSION *our_ssl_sessionid;
+    void *old_ssl_sessionid = NULL;
+
     our_ssl_sessionid = SSL_get_session(backend->handle);
- 
-    Curl_ssl_sessionid_lock(conn); 
-    incache = !(Curl_ssl_getsessionid(conn, &old_ssl_sessionid, NULL, 
-                                      sockindex)); 
-    if(incache) { 
-      if(old_ssl_sessionid != our_ssl_sessionid) { 
-        infof(data, "old SSL session ID is stale, removing\n"); 
-        Curl_ssl_delsessionid(conn, old_ssl_sessionid); 
-        incache = FALSE; 
-      } 
-    } 
- 
-    if(!incache) { 
-      result = Curl_ssl_addsessionid(conn, our_ssl_sessionid, 
-                                     0 /* unknown size */, sockindex); 
-      if(result) { 
-        Curl_ssl_sessionid_unlock(conn); 
-        failf(data, "failed to store ssl session"); 
-        return result; 
-      } 
-    } 
-    Curl_ssl_sessionid_unlock(conn); 
-  } 
- 
-  connssl->connecting_state = ssl_connect_done; 
- 
-  return result; 
-} 
- 
- 
-static ssize_t wolfssl_send(struct connectdata *conn, 
-                           int sockindex, 
-                           const void *mem, 
-                           size_t len, 
-                           CURLcode *curlcode) 
-{ 
-  struct ssl_connect_data *connssl = &conn->ssl[sockindex]; 
+
+    Curl_ssl_sessionid_lock(conn);
+    incache = !(Curl_ssl_getsessionid(conn, &old_ssl_sessionid, NULL,
+                                      sockindex));
+    if(incache) {
+      if(old_ssl_sessionid != our_ssl_sessionid) {
+        infof(data, "old SSL session ID is stale, removing\n");
+        Curl_ssl_delsessionid(conn, old_ssl_sessionid);
+        incache = FALSE;
+      }
+    }
+
+    if(!incache) {
+      result = Curl_ssl_addsessionid(conn, our_ssl_sessionid,
+                                     0 /* unknown size */, sockindex);
+      if(result) {
+        Curl_ssl_sessionid_unlock(conn);
+        failf(data, "failed to store ssl session");
+        return result;
+      }
+    }
+    Curl_ssl_sessionid_unlock(conn);
+  }
+
+  connssl->connecting_state = ssl_connect_done;
+
+  return result;
+}
+
+
+static ssize_t wolfssl_send(struct connectdata *conn,
+                           int sockindex,
+                           const void *mem,
+                           size_t len,
+                           CURLcode *curlcode)
+{
+  struct ssl_connect_data *connssl = &conn->ssl[sockindex];
   struct ssl_backend_data *backend = connssl->backend;
-  char error_buffer[WOLFSSL_MAX_ERROR_SZ]; 
+  char error_buffer[WOLFSSL_MAX_ERROR_SZ];
   int memlen = (len > (size_t)INT_MAX) ? INT_MAX : (int)len;
   int rc = SSL_write(backend->handle, mem, memlen);
- 
-  if(rc < 0) { 
+
+  if(rc < 0) {
     int err = SSL_get_error(backend->handle, rc);
- 
-    switch(err) { 
-    case SSL_ERROR_WANT_READ: 
-    case SSL_ERROR_WANT_WRITE: 
-      /* there's data pending, re-invoke SSL_write() */ 
-      *curlcode = CURLE_AGAIN; 
-      return -1; 
-    default: 
-      failf(conn->data, "SSL write: %s, errno %d", 
-            ERR_error_string(err, error_buffer), 
-            SOCKERRNO); 
-      *curlcode = CURLE_SEND_ERROR; 
-      return -1; 
-    } 
-  } 
-  return rc; 
-} 
- 
-static void Curl_wolfssl_close(struct connectdata *conn, int sockindex) 
-{ 
-  struct ssl_connect_data *connssl = &conn->ssl[sockindex]; 
+
+    switch(err) {
+    case SSL_ERROR_WANT_READ:
+    case SSL_ERROR_WANT_WRITE:
+      /* there's data pending, re-invoke SSL_write() */
+      *curlcode = CURLE_AGAIN;
+      return -1;
+    default:
+      failf(conn->data, "SSL write: %s, errno %d",
+            ERR_error_string(err, error_buffer),
+            SOCKERRNO);
+      *curlcode = CURLE_SEND_ERROR;
+      return -1;
+    }
+  }
+  return rc;
+}
+
+static void Curl_wolfssl_close(struct connectdata *conn, int sockindex)
+{
+  struct ssl_connect_data *connssl = &conn->ssl[sockindex];
   struct ssl_backend_data *backend = connssl->backend;
- 
+
   if(backend->handle) {
     (void)SSL_shutdown(backend->handle);
     SSL_free(backend->handle);
     backend->handle = NULL;
-  } 
+  }
   if(backend->ctx) {
     SSL_CTX_free(backend->ctx);
     backend->ctx = NULL;
-  } 
-} 
- 
-static ssize_t wolfssl_recv(struct connectdata *conn, 
+  }
+}
+
+static ssize_t wolfssl_recv(struct connectdata *conn,
                             int num,
                             char *buf,
                             size_t buffersize,
                             CURLcode *curlcode)
-{ 
-  struct ssl_connect_data *connssl = &conn->ssl[num]; 
+{
+  struct ssl_connect_data *connssl = &conn->ssl[num];
   struct ssl_backend_data *backend = connssl->backend;
-  char error_buffer[WOLFSSL_MAX_ERROR_SZ]; 
+  char error_buffer[WOLFSSL_MAX_ERROR_SZ];
   int buffsize = (buffersize > (size_t)INT_MAX) ? INT_MAX : (int)buffersize;
   int nread = SSL_read(backend->handle, buf, buffsize);
- 
-  if(nread < 0) { 
+
+  if(nread < 0) {
     int err = SSL_get_error(backend->handle, nread);
- 
-    switch(err) { 
-    case SSL_ERROR_ZERO_RETURN: /* no more data */ 
-      break; 
-    case SSL_ERROR_WANT_READ: 
-    case SSL_ERROR_WANT_WRITE: 
-      /* there's data pending, re-invoke SSL_read() */ 
-      *curlcode = CURLE_AGAIN; 
-      return -1; 
-    default: 
-      failf(conn->data, "SSL read: %s, errno %d", 
-            ERR_error_string(err, error_buffer), 
-            SOCKERRNO); 
-      *curlcode = CURLE_RECV_ERROR; 
-      return -1; 
-    } 
-  } 
-  return nread; 
-} 
- 
- 
-static void Curl_wolfssl_session_free(void *ptr) 
-{ 
-  (void)ptr; 
-  /* wolfSSL reuses sessions on own, no free */ 
-} 
- 
- 
-static size_t Curl_wolfssl_version(char *buffer, size_t size) 
-{ 
-#if LIBWOLFSSL_VERSION_HEX >= 0x03006000 
-  return msnprintf(buffer, size, "wolfSSL/%s", wolfSSL_lib_version()); 
-#elif defined(WOLFSSL_VERSION) 
-  return msnprintf(buffer, size, "wolfSSL/%s", WOLFSSL_VERSION); 
-#endif 
-} 
- 
- 
-static int Curl_wolfssl_init(void) 
-{ 
+
+    switch(err) {
+    case SSL_ERROR_ZERO_RETURN: /* no more data */
+      break;
+    case SSL_ERROR_WANT_READ:
+    case SSL_ERROR_WANT_WRITE:
+      /* there's data pending, re-invoke SSL_read() */
+      *curlcode = CURLE_AGAIN;
+      return -1;
+    default:
+      failf(conn->data, "SSL read: %s, errno %d",
+            ERR_error_string(err, error_buffer),
+            SOCKERRNO);
+      *curlcode = CURLE_RECV_ERROR;
+      return -1;
+    }
+  }
+  return nread;
+}
+
+
+static void Curl_wolfssl_session_free(void *ptr)
+{
+  (void)ptr;
+  /* wolfSSL reuses sessions on own, no free */
+}
+
+
+static size_t Curl_wolfssl_version(char *buffer, size_t size)
+{
+#if LIBWOLFSSL_VERSION_HEX >= 0x03006000
+  return msnprintf(buffer, size, "wolfSSL/%s", wolfSSL_lib_version());
+#elif defined(WOLFSSL_VERSION)
+  return msnprintf(buffer, size, "wolfSSL/%s", WOLFSSL_VERSION);
+#endif
+}
+
+
+static int Curl_wolfssl_init(void)
+{
 #ifdef OPENSSL_EXTRA
   Curl_tls_keylog_open();
 #endif
-  return (wolfSSL_Init() == SSL_SUCCESS); 
-} 
- 
- 
-static void Curl_wolfssl_cleanup(void) 
-{ 
-  wolfSSL_Cleanup(); 
+  return (wolfSSL_Init() == SSL_SUCCESS);
+}
+
+
+static void Curl_wolfssl_cleanup(void)
+{
+  wolfSSL_Cleanup();
 #ifdef OPENSSL_EXTRA
   Curl_tls_keylog_close();
 #endif
-} 
- 
- 
+}
+
+
 static bool Curl_wolfssl_data_pending(const struct connectdata *conn,
                                       int connindex)
-{ 
-  const struct ssl_connect_data *connssl = &conn->ssl[connindex]; 
+{
+  const struct ssl_connect_data *connssl = &conn->ssl[connindex];
   struct ssl_backend_data *backend = connssl->backend;
   if(backend->handle)   /* SSL is in use */
     return (0 != SSL_pending(backend->handle)) ? TRUE : FALSE;
-  else 
-    return FALSE; 
-} 
- 
- 
-/* 
- * This function is called to shut down the SSL layer but keep the 
- * socket open (CCC - Clear Command Channel) 
- */ 
-static int Curl_wolfssl_shutdown(struct connectdata *conn, int sockindex) 
-{ 
-  int retval = 0; 
-  struct ssl_connect_data *connssl = &conn->ssl[sockindex]; 
+  else
+    return FALSE;
+}
+
+
+/*
+ * This function is called to shut down the SSL layer but keep the
+ * socket open (CCC - Clear Command Channel)
+ */
+static int Curl_wolfssl_shutdown(struct connectdata *conn, int sockindex)
+{
+  int retval = 0;
+  struct ssl_connect_data *connssl = &conn->ssl[sockindex];
   struct ssl_backend_data *backend = connssl->backend;
- 
+
   if(backend->handle) {
     SSL_free(backend->handle);
     backend->handle = NULL;
-  } 
-  return retval; 
-} 
- 
- 
-static CURLcode 
-wolfssl_connect_common(struct connectdata *conn, 
-                      int sockindex, 
-                      bool nonblocking, 
-                      bool *done) 
-{ 
-  CURLcode result; 
-  struct Curl_easy *data = conn->data; 
-  struct ssl_connect_data *connssl = &conn->ssl[sockindex]; 
-  curl_socket_t sockfd = conn->sock[sockindex]; 
-  int what; 
- 
-  /* check if the connection has already been established */ 
-  if(ssl_connection_complete == connssl->state) { 
-    *done = TRUE; 
-    return CURLE_OK; 
-  } 
- 
-  if(ssl_connect_1 == connssl->connecting_state) { 
-    /* Find out how much more time we're allowed */ 
+  }
+  return retval;
+}
+
+
+static CURLcode
+wolfssl_connect_common(struct connectdata *conn,
+                      int sockindex,
+                      bool nonblocking,
+                      bool *done)
+{
+  CURLcode result;
+  struct Curl_easy *data = conn->data;
+  struct ssl_connect_data *connssl = &conn->ssl[sockindex];
+  curl_socket_t sockfd = conn->sock[sockindex];
+  int what;
+
+  /* check if the connection has already been established */
+  if(ssl_connection_complete == connssl->state) {
+    *done = TRUE;
+    return CURLE_OK;
+  }
+
+  if(ssl_connect_1 == connssl->connecting_state) {
+    /* Find out how much more time we're allowed */
     const timediff_t timeout_ms = Curl_timeleft(data, NULL, TRUE);
- 
-    if(timeout_ms < 0) { 
-      /* no need to continue if time already is up */ 
-      failf(data, "SSL connection timeout"); 
-      return CURLE_OPERATION_TIMEDOUT; 
-    } 
- 
-    result = wolfssl_connect_step1(conn, sockindex); 
-    if(result) 
-      return result; 
-  } 
- 
-  while(ssl_connect_2 == connssl->connecting_state || 
-        ssl_connect_2_reading == connssl->connecting_state || 
-        ssl_connect_2_writing == connssl->connecting_state) { 
- 
-    /* check allowed time left */ 
+
+    if(timeout_ms < 0) {
+      /* no need to continue if time already is up */
+      failf(data, "SSL connection timeout");
+      return CURLE_OPERATION_TIMEDOUT;
+    }
+
+    result = wolfssl_connect_step1(conn, sockindex);
+    if(result)
+      return result;
+  }
+
+  while(ssl_connect_2 == connssl->connecting_state ||
+        ssl_connect_2_reading == connssl->connecting_state ||
+        ssl_connect_2_writing == connssl->connecting_state) {
+
+    /* check allowed time left */
     const timediff_t timeout_ms = Curl_timeleft(data, NULL, TRUE);
- 
-    if(timeout_ms < 0) { 
-      /* no need to continue if time already is up */ 
-      failf(data, "SSL connection timeout"); 
-      return CURLE_OPERATION_TIMEDOUT; 
-    } 
- 
-    /* if ssl is expecting something, check if it's available. */ 
-    if(connssl->connecting_state == ssl_connect_2_reading 
-       || connssl->connecting_state == ssl_connect_2_writing) { 
- 
-      curl_socket_t writefd = ssl_connect_2_writing == 
-        connssl->connecting_state?sockfd:CURL_SOCKET_BAD; 
-      curl_socket_t readfd = ssl_connect_2_reading == 
-        connssl->connecting_state?sockfd:CURL_SOCKET_BAD; 
- 
-      what = Curl_socket_check(readfd, CURL_SOCKET_BAD, writefd, 
-                               nonblocking?0:timeout_ms); 
-      if(what < 0) { 
-        /* fatal error */ 
-        failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO); 
-        return CURLE_SSL_CONNECT_ERROR; 
-      } 
-      else if(0 == what) { 
-        if(nonblocking) { 
-          *done = FALSE; 
-          return CURLE_OK; 
-        } 
-        else { 
-          /* timeout */ 
-          failf(data, "SSL connection timeout"); 
-          return CURLE_OPERATION_TIMEDOUT; 
-        } 
-      } 
-      /* socket is readable or writable */ 
-    } 
- 
-    /* Run transaction, and return to the caller if it failed or if 
-     * this connection is part of a multi handle and this loop would 
-     * execute again. This permits the owner of a multi handle to 
-     * abort a connection attempt before step2 has completed while 
-     * ensuring that a client using select() or epoll() will always 
-     * have a valid fdset to wait on. 
-     */ 
-    result = wolfssl_connect_step2(conn, sockindex); 
-    if(result || (nonblocking && 
-                  (ssl_connect_2 == connssl->connecting_state || 
-                   ssl_connect_2_reading == connssl->connecting_state || 
-                   ssl_connect_2_writing == connssl->connecting_state))) 
-      return result; 
-  } /* repeat step2 until all transactions are done. */ 
- 
-  if(ssl_connect_3 == connssl->connecting_state) { 
-    result = wolfssl_connect_step3(conn, sockindex); 
-    if(result) 
-      return result; 
-  } 
- 
-  if(ssl_connect_done == connssl->connecting_state) { 
-    connssl->state = ssl_connection_complete; 
-    conn->recv[sockindex] = wolfssl_recv; 
-    conn->send[sockindex] = wolfssl_send; 
-    *done = TRUE; 
-  } 
-  else 
-    *done = FALSE; 
- 
-  /* Reset our connect state machine */ 
-  connssl->connecting_state = ssl_connect_1; 
- 
-  return CURLE_OK; 
-} 
- 
- 
-static CURLcode Curl_wolfssl_connect_nonblocking(struct connectdata *conn, 
-                                                int sockindex, bool *done) 
-{ 
-  return wolfssl_connect_common(conn, sockindex, TRUE, done); 
-} 
- 
- 
-static CURLcode Curl_wolfssl_connect(struct connectdata *conn, int sockindex) 
-{ 
-  CURLcode result; 
-  bool done = FALSE; 
- 
-  result = wolfssl_connect_common(conn, sockindex, FALSE, &done); 
-  if(result) 
-    return result; 
- 
-  DEBUGASSERT(done); 
- 
-  return CURLE_OK; 
-} 
- 
-static CURLcode Curl_wolfssl_random(struct Curl_easy *data, 
-                                   unsigned char *entropy, size_t length) 
-{ 
+
+    if(timeout_ms < 0) {
+      /* no need to continue if time already is up */
+      failf(data, "SSL connection timeout");
+      return CURLE_OPERATION_TIMEDOUT;
+    }
+
+    /* if ssl is expecting something, check if it's available. */
+    if(connssl->connecting_state == ssl_connect_2_reading
+       || connssl->connecting_state == ssl_connect_2_writing) {
+
+      curl_socket_t writefd = ssl_connect_2_writing ==
+        connssl->connecting_state?sockfd:CURL_SOCKET_BAD;
+      curl_socket_t readfd = ssl_connect_2_reading ==
+        connssl->connecting_state?sockfd:CURL_SOCKET_BAD;
+
+      what = Curl_socket_check(readfd, CURL_SOCKET_BAD, writefd,
+                               nonblocking?0:timeout_ms);
+      if(what < 0) {
+        /* fatal error */
+        failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO);
+        return CURLE_SSL_CONNECT_ERROR;
+      }
+      else if(0 == what) {
+        if(nonblocking) {
+          *done = FALSE;
+          return CURLE_OK;
+        }
+        else {
+          /* timeout */
+          failf(data, "SSL connection timeout");
+          return CURLE_OPERATION_TIMEDOUT;
+        }
+      }
+      /* socket is readable or writable */
+    }
+
+    /* Run transaction, and return to the caller if it failed or if
+     * this connection is part of a multi handle and this loop would
+     * execute again. This permits the owner of a multi handle to
+     * abort a connection attempt before step2 has completed while
+     * ensuring that a client using select() or epoll() will always
+     * have a valid fdset to wait on.
+     */
+    result = wolfssl_connect_step2(conn, sockindex);
+    if(result || (nonblocking &&
+                  (ssl_connect_2 == connssl->connecting_state ||
+                   ssl_connect_2_reading == connssl->connecting_state ||
+                   ssl_connect_2_writing == connssl->connecting_state)))
+      return result;
+  } /* repeat step2 until all transactions are done. */
+
+  if(ssl_connect_3 == connssl->connecting_state) {
+    result = wolfssl_connect_step3(conn, sockindex);
+    if(result)
+      return result;
+  }
+
+  if(ssl_connect_done == connssl->connecting_state) {
+    connssl->state = ssl_connection_complete;
+    conn->recv[sockindex] = wolfssl_recv;
+    conn->send[sockindex] = wolfssl_send;
+    *done = TRUE;
+  }
+  else
+    *done = FALSE;
+
+  /* Reset our connect state machine */
+  connssl->connecting_state = ssl_connect_1;
+
+  return CURLE_OK;
+}
+
+
+static CURLcode Curl_wolfssl_connect_nonblocking(struct connectdata *conn,
+                                                int sockindex, bool *done)
+{
+  return wolfssl_connect_common(conn, sockindex, TRUE, done);
+}
+
+
+static CURLcode Curl_wolfssl_connect(struct connectdata *conn, int sockindex)
+{
+  CURLcode result;
+  bool done = FALSE;
+
+  result = wolfssl_connect_common(conn, sockindex, FALSE, &done);
+  if(result)
+    return result;
+
+  DEBUGASSERT(done);
+
+  return CURLE_OK;
+}
+
+static CURLcode Curl_wolfssl_random(struct Curl_easy *data,
+                                   unsigned char *entropy, size_t length)
+{
   WC_RNG rng;
-  (void)data; 
-  if(wc_InitRng(&rng)) 
-    return CURLE_FAILED_INIT; 
-  if(length > UINT_MAX) 
-    return CURLE_FAILED_INIT; 
-  if(wc_RNG_GenerateBlock(&rng, entropy, (unsigned)length)) 
-    return CURLE_FAILED_INIT; 
-  if(wc_FreeRng(&rng)) 
-    return CURLE_FAILED_INIT; 
-  return CURLE_OK; 
-} 
- 
-static CURLcode Curl_wolfssl_sha256sum(const unsigned char *tmp, /* input */ 
+  (void)data;
+  if(wc_InitRng(&rng))
+    return CURLE_FAILED_INIT;
+  if(length > UINT_MAX)
+    return CURLE_FAILED_INIT;
+  if(wc_RNG_GenerateBlock(&rng, entropy, (unsigned)length))
+    return CURLE_FAILED_INIT;
+  if(wc_FreeRng(&rng))
+    return CURLE_FAILED_INIT;
+  return CURLE_OK;
+}
+
+static CURLcode Curl_wolfssl_sha256sum(const unsigned char *tmp, /* input */
                                        size_t tmplen,
                                        unsigned char *sha256sum /* output */,
                                        size_t unused)
-{ 
+{
   wc_Sha256 SHA256pw;
-  (void)unused; 
-  wc_InitSha256(&SHA256pw); 
-  wc_Sha256Update(&SHA256pw, tmp, (word32)tmplen); 
-  wc_Sha256Final(&SHA256pw, sha256sum); 
-  return CURLE_OK; 
-} 
- 
-static void *Curl_wolfssl_get_internals(struct ssl_connect_data *connssl, 
+  (void)unused;
+  wc_InitSha256(&SHA256pw);
+  wc_Sha256Update(&SHA256pw, tmp, (word32)tmplen);
+  wc_Sha256Final(&SHA256pw, sha256sum);
+  return CURLE_OK;
+}
+
+static void *Curl_wolfssl_get_internals(struct ssl_connect_data *connssl,
                                         CURLINFO info UNUSED_PARAM)
-{ 
+{
   struct ssl_backend_data *backend = connssl->backend;
-  (void)info; 
+  (void)info;
   return backend->handle;
-} 
- 
-const struct Curl_ssl Curl_ssl_wolfssl = { 
-  { CURLSSLBACKEND_WOLFSSL, "WolfSSL" }, /* info */ 
- 
-#ifdef KEEP_PEER_CERT 
-  SSLSUPP_PINNEDPUBKEY | 
-#endif 
-  SSLSUPP_SSL_CTX, 
- 
-  sizeof(struct ssl_backend_data), 
- 
-  Curl_wolfssl_init,                /* init */ 
-  Curl_wolfssl_cleanup,             /* cleanup */ 
-  Curl_wolfssl_version,             /* version */ 
-  Curl_none_check_cxn,             /* check_cxn */ 
-  Curl_wolfssl_shutdown,            /* shutdown */ 
-  Curl_wolfssl_data_pending,        /* data_pending */ 
-  Curl_wolfssl_random,              /* random */ 
-  Curl_none_cert_status_request,   /* cert_status_request */ 
-  Curl_wolfssl_connect,             /* connect */ 
-  Curl_wolfssl_connect_nonblocking, /* connect_nonblocking */ 
-  Curl_wolfssl_get_internals,       /* get_internals */ 
-  Curl_wolfssl_close,               /* close_one */ 
-  Curl_none_close_all,             /* close_all */ 
-  Curl_wolfssl_session_free,        /* session_free */ 
-  Curl_none_set_engine,            /* set_engine */ 
-  Curl_none_set_engine_default,    /* set_engine_default */ 
-  Curl_none_engines_list,          /* engines_list */ 
-  Curl_none_false_start,           /* false_start */ 
-  Curl_none_md5sum,                /* md5sum */ 
-  Curl_wolfssl_sha256sum            /* sha256sum */ 
-}; 
- 
-#endif 
+}
+
+const struct Curl_ssl Curl_ssl_wolfssl = {
+  { CURLSSLBACKEND_WOLFSSL, "WolfSSL" }, /* info */
+
+#ifdef KEEP_PEER_CERT
+  SSLSUPP_PINNEDPUBKEY |
+#endif
+  SSLSUPP_SSL_CTX,
+
+  sizeof(struct ssl_backend_data),
+
+  Curl_wolfssl_init,                /* init */
+  Curl_wolfssl_cleanup,             /* cleanup */
+  Curl_wolfssl_version,             /* version */
+  Curl_none_check_cxn,             /* check_cxn */
+  Curl_wolfssl_shutdown,            /* shutdown */
+  Curl_wolfssl_data_pending,        /* data_pending */
+  Curl_wolfssl_random,              /* random */
+  Curl_none_cert_status_request,   /* cert_status_request */
+  Curl_wolfssl_connect,             /* connect */
+  Curl_wolfssl_connect_nonblocking, /* connect_nonblocking */
+  Curl_wolfssl_get_internals,       /* get_internals */
+  Curl_wolfssl_close,               /* close_one */
+  Curl_none_close_all,             /* close_all */
+  Curl_wolfssl_session_free,        /* session_free */
+  Curl_none_set_engine,            /* set_engine */
+  Curl_none_set_engine_default,    /* set_engine_default */
+  Curl_none_engines_list,          /* engines_list */
+  Curl_none_false_start,           /* false_start */
+  Curl_none_md5sum,                /* md5sum */
+  Curl_wolfssl_sha256sum            /* sha256sum */
+};
+
+#endif
diff --git a/contrib/libs/curl/lib/vtls/wolfssl.h b/contrib/libs/curl/lib/vtls/wolfssl.h
index b2d7fb53c1..d411e6913e 100644
--- a/contrib/libs/curl/lib/vtls/wolfssl.h
+++ b/contrib/libs/curl/lib/vtls/wolfssl.h
@@ -1,31 +1,31 @@
-#ifndef HEADER_CURL_WOLFSSL_H 
-#define HEADER_CURL_WOLFSSL_H 
-/*************************************************************************** 
- *                                  _   _ ____  _ 
- *  Project                     ___| | | |  _ \| | 
- *                             / __| | | | |_) | | 
- *                            | (__| |_| |  _ <| |___ 
- *                             \___|\___/|_| \_\_____| 
- * 
+#ifndef HEADER_CURL_WOLFSSL_H
+#define HEADER_CURL_WOLFSSL_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
  * Copyright (C) 1998 - 2020, Daniel Stenberg, <daniel@haxx.se>, et al.
- * 
- * This software is licensed as described in the file COPYING, which 
- * you should have received as part of this distribution. The terms 
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
  * are also available at https://curl.se/docs/copyright.html.
- * 
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell 
- * copies of the Software, and permit persons to whom the Software is 
- * furnished to do so, under the terms of the COPYING file. 
- * 
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY 
- * KIND, either express or implied. 
- * 
- ***************************************************************************/ 
-#include "curl_setup.h" 
- 
-#ifdef USE_WOLFSSL 
- 
-extern const struct Curl_ssl Curl_ssl_wolfssl; 
- 
-#endif /* USE_WOLFSSL */ 
-#endif /* HEADER_CURL_WOLFSSL_H */ 
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#ifdef USE_WOLFSSL
+
+extern const struct Curl_ssl Curl_ssl_wolfssl;
+
+#endif /* USE_WOLFSSL */
+#endif /* HEADER_CURL_WOLFSSL_H */