gnunet-svn
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[GNUnet-SVN] [gnurl] branch master updated (cb5937f5c -> 2a23ac742)


From: gnunet
Subject: [GNUnet-SVN] [gnurl] branch master updated (cb5937f5c -> 2a23ac742)
Date: Sun, 05 Aug 2018 12:35:26 +0200

This is an automated email from the git hooks/post-receive script.

ng0 pushed a change to branch master
in repository gnurl.

    from cb5937f5c todo
     new 1592ea979 schannel: disable client cert option if APIs not available
     new 4584cc449 schannel: disable manual verify if APIs not available
     new 4f9bbd3ac rand: fix typo
     new f0c466dce schannel_verify: fix build for non-schannel
     new d9e92fd9f tests/libtest/Makefile: Do not unconditionally add 
gcc-specific flags
     new 3b6802cb9 bump: start working on the pending 7.61.0
     new c5fe86804 openssl: acknowledge --tls-max for default version too
     new ce2140a8c getinfo: add microsecond precise timers for various intervals
     new a1c02ac81 stub_gssapi: fix numerous 'unused parameter' warnings
     new ccf85d4c2 examples/progressfunc: make it build on older libcurls
     new e05ad5dd9 docs: mention HAproxy protocol "version 1"
     new 27aebcc1d checksrc: fix too long line
     new 404c8850d curl_fnmatch: only allow two asterisks for matching
     new d5a2df5f1 docs: clarify CURLOPT_HTTPGET somewhat
     new 302d53742 configure: replace AC_TRY_RUN with CURL_RUN_IFELSE
     new 6876ccf90 configure: compile-time SIZEOF checks
     new c1c27625c curl: show headers in bold
     new f3d836b73 curl: added --styled-output
     new cb529b713 checksrc: make sure sizeof() is used *with* parentheses
     new 6b35e4c94 KNOWN_BUGS: mention the -O with %-encoded file names
     new 3ba334f6e RELEASE-NOTES: synced
     new 2ceab0945 CURLOPT_ACCEPT_ENCODING.3: add brotli and clarify a bit
     new aa0f41a5f schannel: make CAinfo parsing resilient to CR/LF
     new 679fa59ed configure: add missing m4/ax_compile_check_sizeof.m4
     new 2e65a9205 tftp: make sure error is zero terminated before printfing it
     new 09d16af49 http resume: skip body if http code 416 (range error) is 
ignored.
     new d353af001 configure: add basic test of --with-ssl prefix
     new 2c0225e04 cmake: set -d postfix for debug builds if not specified      
  using -DCMAKE_DEBUG_POSTFIX explicitly
     new 49fe65ccd TODO: CURLINFO_PAUSE_STATE
     new 239a7061f httpauth: add support for Bearer tokens
     new 3e0dee065 multi: provide a socket to wait for in Curl_protocol_getsock
     new d0f1d6c8f content_encoding: handle zlib versions too old for Z_BLOCK
     new 8ff755589 winbuild: only delete OUTFILE if it exists
     new 75c51e05a winbuild: In MakefileBuild.vc fix typo DISTDIR->DIRDIST
     new 45eefbd0d schannel: add failf calls for client certificate failures
     new aa18b573c mailmap: a Richard Alcock fixup
     new 7e93637ac Fix the test for fsetxattr and strerror_r tests in CMake to 
work without compiling
     new 3af865cd0 mailmap: Max Savenkov
     new c78dd2e1d docs: fix cmdline-opts metadata headers case consistency.
     new 7c189c660 curl.1: Fix cmdline-opts reference errors.
     new 06a72880d cmdline-opts/gen.pl: warn if mutexes: or see-also: list 
non-existing options
     new 645948dff cmake: check for getpwuid_r
     new eb678badc RELEASE-NOTES: synced
     new 536e9f828 configure: fix ssh2 linking when built with a static mbedtls
     new 8541d02c9 psl: use latest psl and refresh it periodically
     new 6482773d3 fnmatch: insist on escaped bracket to match
     new c2423c37b KNOWN_BUGS: restore text regarding #2101.
     new c10f3a1e0 INSTALL: LDFLAGS=-Wl,-R/usr/local/ssl/lib
     new 954284f91 cmake: fixed comments in compile checks code
     new 5005ade2c configure: override AR_FLAGS to silence warning
     new 050c93c46 setopt: add TLS 1.3 ciphersuites
     new c2dc7d9c6 os400: implement mime api EBCDIC wrappers
     new e40ab75e9 os400: sync EBCDIC wrappers and ILE/RPG binding with latest 
options
     new ebd213270 curl.rc: embed manifest for correct Windows version detection
     new 5f07fca8f libcurl-security.3: refer to URL instead of in-source 
markdown file
     new 71d35e4a1 libcurl-security.3: improved layout for two rememdy lists
     new 946ce5b61 option: disallow username in URL
     new 8ea5d41fe strictness: correct {infof, failf} format specifiers
     new 7179b8393 tests: update .gitignore for libtests
     new 9c33813d8 configure: check for declaration of getpwuid_r
     new 8a6a01c98 KNOWN_BUGS: CURL_GLOBAL_SSL
     new 8c1c9af18 tests/libtest/.gitignore: follow-up fix to ignore lib5* too
     new 6d8c62891 os400: add new option in ILE/RPG binding
     new a115c6bbe fnmatch: use the system one if available
     new f66d97b67 CURLOPT_RESOLVE: always purge old entry first
     new 923ce4a59 multi: remove a DEBUGF()
     new 571280678 curl_addrinfo: use same #ifdef conditions in source as header
     new aca1aba0b build: remove the Borland specific makefiles
     new 9f89cd5ae axTLS: not considered fit for use
     new 71c39f296 axtls: follow-up spell fix of comment
     new 4bd91bc47 spelling fixes
     new a8324599d cmdline-opts/cert-type.d: mention "p12" as a recognized type 
as well
     new f8045799b system.h: add support for IBM xlc C compiler
     new 76457ccde tests/libtest: Add lib1521 to nodist_SOURCES
     new b59cbf746 tests/libtests/Makefile.am: Add lib1521.c to CLEANFILES
     new 9ff67f7b0 mk-ca-bundle.pl: leave certificate name untouched in decode()
     new 274940d74 boringssl + schannel: undef X509_NAME in lib/schannel.h
     new 7e799d22d RELEASE-PROCEDURE: update the release calendar for 2019
     new 100318c7f RELEASE-NOTES: synced
     new 38203f158 openssl: assume engine support in 1.0.1 or later
     new c45360d46 cppcheck: fix warnings
     new f508d29f3 test 46: make test pass after 2025
     new 9aefbff30 schannel: support selecting ciphers
     new 819f44dc0 schannel: avoid incompatible pointer warning
     new 5ae22272d Curl_debug: remove dead printhost code
     new bb9a340c7 runtests: support variables in <strippart>
     new a0f9670ec Curl_init_do: handle NULL connection pointer passed in
     new 54066f5d0 TODO: "Option to refuse usernames in URLs" done
     new 0680ec9e2 progress: remove a set of unused defines
     new 47762f558 mk-ca-bundle.pl: make -u delete certdata.txt if found not 
changed
     new 6bc830448 KNOWN_BUGS: slow connect to localhost on Windows
     new 81758be83 KNOWN_BUGS: NTLM doen't support password with § character
     new 023e80e47 GOVERNANCE.md: explains how this project is run
     new ed224f23d configure: use pkg-config for c-ares detection
     new 351dabbf3 configure: enhance ability to detect/build with static 
openssl
     new cf448436f maketgz: fix sed issues on OSX
     new a78c5c7aa CURLOPT_HTTPAUTH.3: CURLAUTH_BEARER was added in 7.61.0
     new 836f4fb67 RELEASE-NOTES: synced
     new 66f727c8b RELEASE-PROCEDURE: gpg sign the tags
     new f404f9a28 docs/RELEASE-PROCEDURE.md: renamed to use .md extension
     new 687965f20 curl-confopts.m4: fix typo from ed224f23d5beb
     new 99ae23c23 runtests.pl: remove debug leftover from bb9a340c73f3
     new 676f4b742 maketgz: delete .bak files, fix indentation
     new ac9a179fe multi: fix memory leak when stopped during name resolve
     new 6785d0dc7 travis: run more tests for coverage check
     new dfb873e30 CURLOPT_INTERFACE.3: interface names not supported on Windows
     new 2c15693a3 url: fix dangling conn->data pointer
     new 59b284b6e cmake: allow multiple SSL backends
     new bc5a0b3e9 system.h: fix for gcc on 32 bit OpenServer
     new 146178a9d ConnectionExists: make sure conn->data is set when "taking" 
a connection
     new 4c901638b multi: fix crash due to dangling entry in connect-pending 
list
     new b6a16afa0 CURLOPT_SSL_VERIFYPEER.3: Add performance note
     new a3b7cb7e8 netrc: use a larger buffer
     new 810ce3188 CURLOPT_SSL_VERIFYPEER.3: fix syntax mistake
     new 75e8dc050 RELEASE-NOTES: synced
     new 13120f28b include/README: remove "hacking" advice, not the right place
     new f762fec32 url: check Curl_conncache_add_conn return code
     new a5ed2a2cd GOVERNANCE: add maintainer details/duties
     new be231ef88 GOVERNANCE: linkify, changed some titles
     new b0a365f8a configure: Add dependent libraries after crypto
     new 3ef67c686 easy_perform: use *multi_timeout() to get wait times
     new 0aeca4170 getnameinfo: not used
     new a10c974e1 configure: remove CURL_CHECK_NI_WITHSCOPEID too
     new eebd3bb68 travis: add a build using the synchronous name resolver
     new 24cb114c5 CURLINFO_TLS_SSL_PTR.3: improve the example
     new 08c845cfd openssl: allow TLS 1.3 by default
     new b83e3e603 RELEASE-NOTES: synced
     new 6015cefb1 openssl: make the requested TLS version the *minimum* wanted
     new 09a72f5dd openssl: Remove some dead code
     new 9679790b2 docs: fix missed option name markups
     new ab4cf9969 telnet: fix clang warnings
     new f5ba9cea0 DEPRECATE: new doc describing planned item removals
     new 6b919801d docs/DEPRECATE.md: spelling and minor formatting
     new d56feb610 DEPRECATE: mention the PR that disabled axTLS
     new 9aabe91c8 DEPRECATE: linkified
     new 91d03fce9 DEPRECATE: include year when specifying date
     new b0e4598ff RELEASE-NOTES: synced
     new 74e0bde77 example/crawler.c: simple crawler based on libxml2
     new 75105480d KNOWN_BUGS: Borland support is dropped, AIX problem is too 
old
     new 0d3eeaadb libssh: include line number in state change debug messages
     new 03d884b7d libssh: goto DISCONNECT state on error, not SSH_SESSION_FREE
     new 6e61668b9 KNOWN_BUGS: Stick to same family over SOCKS proxy
     new fac400da0 CMake: Remove unused functions
     new b4db3a8a0 CMake: Remove unused 'output_var' from 'collect_true'
     new b78d1a3d4 darwinssl: allow High Sierra users to build the code using 
GCC
     new 0b4ccc97f scripts: include _curl as part of CLEANFILES
     new ba1dbd78e smtp: use the upload buffer size for scratch buffer malloc
     new 5bd8c389a examples: fix -Wformat warnings
     new 8272ec50f curl_setup: include <winerror.h> before <windows.h>
     new a189ab91f schannel: make more cipher options conditional
     new 07f7c93f9 schannel: workaround for wrong function signature in w32api
     new 424f1cfef schannel: fix -Wsign-compare warning
     new 82ce41622 lib/curl_setup.h: remove unicode bom from 8272ec50f02
     new 685dc3c08 lib/curl_setup.h: remove unicode character
     new e0a4bba73 CMake: remove redundant and old end-of-block syntax
     new 522236f55 post303.d: clarify that this is an RFC violation
     new d3bd7cb38 TODO: Configurable loading of OpenSSL configuration file
     new eb8138405 release: 7.61.0
     new e81185667 Merge tag 'curl-7_61_0'
     new 5561c699b gnurl: post-merge adjustments
     new 1c2a2c19c gnurl: sed script
     new 53f2f1609 gnurl: rename CURLINFO and CURLOPT section 3 manpages 
post-merge
     new 2a23ac742 gnurl: bump version in guix.scm

The 163 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.


Summary of changes:
 .mailmap                                           |   2 +
 .travis.yml                                        |  10 +-
 CMake/CurlTests.c                                  |  30 +-
 CMake/Macros.cmake                                 |  28 +-
 CMake/OtherTests.cmake                             |  61 ++-
 CMake/Platforms/WindowsCache.cmake                 |   7 +-
 CMake/Utilities.cmake                              |  41 +-
 CMakeLists.txt                                     | 126 +++---
 Makefile.dist                                      |  26 +-
 RELEASE-NOTES                                      | 435 ++++++++++-----------
 acinclude.m4                                       | 311 +--------------
 aux-gnurl/sed.sh                                   |   7 +-
 configure.ac                                       |  30 +-
 docs/CIPHERS.md                                    |  61 +++
 docs/DEPRECATE.md                                  |  73 ++++
 docs/GOVERNANCE.md                                 | 144 +++++++
 docs/INSTALL.md                                    |  52 +--
 docs/KNOWN_BUGS                                    |  85 +++-
 docs/MAIL-ETIQUETTE                                |   2 +-
 docs/Makefile.am                                   |  47 ++-
 docs/{RELEASE-PROCEDURE => RELEASE-PROCEDURE.md}   |  13 +-
 docs/THANKS                                        |  25 ++
 docs/TODO                                          |  29 +-
 docs/cmdline-opts/Makefile.inc                     |   3 +-
 docs/cmdline-opts/cert-type.d                      |   6 +-
 docs/cmdline-opts/ciphers.d                        |   2 +-
 docs/cmdline-opts/data.d                           |   2 +-
 docs/cmdline-opts/disallow-username-in-url.d       |   7 +
 docs/cmdline-opts/form.d                           |   2 +-
 docs/cmdline-opts/gen.pl                           |   6 +
 docs/cmdline-opts/haproxy-protocol.d               |   4 +-
 docs/cmdline-opts/ntlm.d                           |   2 +-
 docs/cmdline-opts/post303.d                        |   9 +-
 docs/cmdline-opts/proxy-service-name.d             |   2 +-
 docs/cmdline-opts/proxy-tls13-ciphers.d            |  12 +
 docs/cmdline-opts/remote-time.d                    |   4 +-
 docs/cmdline-opts/retry-delay.d                    |   4 +-
 docs/cmdline-opts/retry-max-time.d                 |   2 +-
 docs/cmdline-opts/sasl-ir.d                        |   2 +-
 docs/cmdline-opts/show-error.d                     |   2 +-
 docs/cmdline-opts/silent.d                         |   2 +-
 docs/cmdline-opts/ssl-reqd.d                       |   2 +-
 docs/cmdline-opts/ssl.d                            |   2 +-
 docs/cmdline-opts/styled-output.d                  |   6 +
 docs/cmdline-opts/tftp-blksize.d                   |   2 +-
 docs/cmdline-opts/tls13-ciphers.d                  |  12 +
 docs/cmdline-opts/tlsv1.1.d                        |   2 +-
 docs/cmdline-opts/tlsv1.2.d                        |   2 +-
 docs/cmdline-opts/tlsv1.3.d                        |   2 +-
 docs/cmdline-opts/tlsv1.d                          |   4 +-
 docs/cmdline-opts/url.d                            |   2 +-
 docs/examples/Makefile.inc                         |   2 +-
 docs/examples/Makefile.netware                     |   4 +-
 docs/examples/cacertinmem.c                        |   4 +-
 docs/examples/chkspeed.c                           |  26 +-
 docs/examples/crawler.c                            | 210 ++++++++++
 docs/examples/curlx.c                              |   2 +-
 docs/examples/debug.c                              |   4 +-
 docs/examples/fileupload.c                         |  12 +-
 docs/examples/getinmemory.c                        |   2 +-
 docs/examples/http2-download.c                     |   4 +-
 docs/examples/http2-serverpush.c                   |   8 +-
 docs/examples/http2-upload.c                       |   4 +-
 docs/examples/multi-debugcallback.c                |   4 +-
 docs/examples/multi-uv.c                           |   4 +-
 docs/examples/progressfunc.c                       |  40 +-
 docs/examples/smtp-mime.c                          |   2 +-
 docs/examples/threaded-shared-conn.c               |   2 +-
 docs/libcurl/gnurl_easy_getinfo.3                  |  46 ++-
 docs/libcurl/gnurl_easy_setopt.3                   |   8 +-
 docs/libcurl/gnurl_multi_add_handle.3              |  12 +-
 docs/libcurl/gnurl_multi_socket.3                  |  21 +-
 docs/libcurl/gnurl_multi_socket_action.3           |  10 +-
 docs/libcurl/gnurl_share_setopt.3                  |   9 +
 docs/libcurl/libgnurl-multi.3                      |  20 +-
 docs/libcurl/libgnurl-security.3                   |  24 +-
 docs/libcurl/opts/GNURLINFO_APPCONNECT_TIME.3      |   2 +-
 ...ONNECT_TIME.3 => GNURLINFO_APPCONNECT_TIME_T.3} |  24 +-
 docs/libcurl/opts/GNURLINFO_CONNECT_TIME.3         |   2 +-
 ...O_CONNECT_TIME.3 => GNURLINFO_CONNECT_TIME_T.3} |  24 +-
 docs/libcurl/opts/GNURLINFO_NAMELOOKUP_TIME.3      |   2 +-
 ...LOOKUP_TIME.3 => GNURLINFO_NAMELOOKUP_TIME_T.3} |  23 +-
 docs/libcurl/opts/GNURLINFO_PRETRANSFER_TIME.3     |   2 +-
 ...NSFER_TIME.3 => GNURLINFO_PRETRANSFER_TIME_T.3} |  22 +-
 docs/libcurl/opts/GNURLINFO_REDIRECT_TIME.3        |   2 +-
 ...REDIRECT_TIME.3 => GNURLINFO_REDIRECT_TIME_T.3} |  26 +-
 docs/libcurl/opts/GNURLINFO_STARTTRANSFER_TIME.3   |   2 +-
 ...FER_TIME.3 => GNURLINFO_STARTTRANSFER_TIME_T.3} |  24 +-
 docs/libcurl/opts/GNURLINFO_TLS_SSL_PTR.3          |  35 +-
 docs/libcurl/opts/GNURLINFO_TOTAL_TIME.3           |   2 +-
 ...NFO_CONNECT_TIME.3 => GNURLINFO_TOTAL_TIME_T.3} |  24 +-
 docs/libcurl/opts/GNURLOPT_ACCEPT_ENCODING.3       |  20 +-
 ..._PORT.3 => GNURLOPT_DISALLOW_USERNAME_IN_URL.3} |  36 +-
 docs/libcurl/opts/GNURLOPT_HAPROXYPROTOCOL.3       |   8 +-
 docs/libcurl/opts/GNURLOPT_HTTPAUTH.3              |   8 +-
 docs/libcurl/opts/GNURLOPT_HTTPGET.3               |  13 +-
 docs/libcurl/opts/GNURLOPT_INTERFACE.3             |   5 +-
 docs/libcurl/opts/GNURLOPT_POST.3                  |   6 +-
 docs/libcurl/opts/GNURLOPT_POSTFIELDS.3            |   4 +-
 ..._SSLENGINE.3 => GNURLOPT_PROXY_TLS13_CIPHERS.3} |  41 +-
 docs/libcurl/opts/GNURLOPT_RESOLVE.3               |   5 +
 docs/libcurl/opts/GNURLOPT_SSLVERSION.3            |  42 +-
 docs/libcurl/opts/GNURLOPT_SSL_VERIFYPEER.3        |  12 +-
 ...URLOPT_EGDSOCKET.3 => GNURLOPT_TLS13_CIPHERS.3} |  30 +-
 docs/libcurl/opts/GNURLOPT_WILDCARDMATCH.3         |   4 +-
 docs/libcurl/opts/GNURLOPT_XOAUTH2_BEARER.3        |   8 +-
 docs/libcurl/opts/Makefile.inc                     |  10 +
 docs/libcurl/symbols-in-versions                   |  18 +-
 guix.scm                                           |   2 +-
 include/README                                     |  19 +-
 include/gnurl/curl.h                               |  22 +-
 include/gnurl/curlver.h                            |   6 +-
 include/gnurl/system.h                             |  20 +-
 include/gnurl/typecheck-gcc.h                      |   2 +-
 lib/CMakeLists.txt                                 |   7 -
 lib/Makefile.am                                    |   4 +-
 lib/Makefile.b32                                   | 185 ---------
 lib/Makefile.inc                                   |   4 +-
 lib/Makefile.netware                               |   4 +-
 lib/asyn-ares.c                                    |  19 +-
 lib/asyn-thread.c                                  |  12 +-
 lib/base64.c                                       |   3 +-
 lib/checksrc.pl                                    |  12 +
 lib/conncache.c                                    |  37 +-
 lib/conncache.h                                    |   4 +-
 lib/connect.c                                      |  12 +-
 lib/content_encoding.c                             |  14 +-
 lib/cookie.c                                       |  54 +--
 lib/curl_addrinfo.c                                |   3 +-
 lib/curl_config.h.cmake                            |   6 +
 lib/curl_fnmatch.c                                 |  43 +-
 lib/curl_sasl.c                                    |   3 +-
 lib/curl_setup.h                                   |  10 +-
 lib/dict.c                                         |   6 +-
 lib/easy.c                                         |  27 +-
 lib/escape.c                                       |   6 +-
 lib/file.c                                         |   8 +-
 lib/formdata.c                                     |   5 +-
 lib/ftp.c                                          |  16 +-
 lib/getinfo.c                                      |  22 ++
 lib/hash.c                                         |  11 +-
 lib/hmac.c                                         |   4 +-
 lib/hostip.c                                       |  34 +-
 lib/hostip6.c                                      |  35 +-
 lib/http.c                                         | 101 +++--
 lib/http2.c                                        |  16 +-
 lib/http_proxy.c                                   |   6 +-
 lib/imap.c                                         |  16 +-
 lib/inet_ntop.c                                    |   2 +-
 lib/ldap.c                                         |   9 -
 lib/md5.c                                          |   2 +-
 lib/memdebug.h                                     |   9 +-
 lib/mime.c                                         |  44 +--
 lib/mk-ca-bundle.pl                                |   7 +-
 lib/multi.c                                        |  73 +++-
 lib/multihandle.h                                  |   8 +-
 lib/netrc.c                                        |   4 +-
 lib/pingpong.c                                     |  10 +-
 lib/pipeline.c                                     |   3 +-
 lib/pop3.c                                         |   4 +-
 lib/progress.c                                     |  39 +-
 lib/progress.h                                     |  13 -
 lib/psl.c                                          | 111 ++++++
 src/tool_filetime.h => lib/psl.h                   |  33 +-
 lib/rand.c                                         |   2 +-
 lib/rtsp.c                                         |   6 +-
 lib/security.c                                     |   4 +-
 lib/select.c                                       |   8 +-
 lib/sendf.c                                        |  48 +--
 lib/sendf.h                                        |   5 +-
 lib/setopt.c                                       |  34 +-
 lib/sha256.c                                       |  12 +-
 lib/share.c                                        |  11 +-
 lib/share.h                                        |   6 +-
 lib/smtp.c                                         |   5 +-
 lib/socks.c                                        |   8 +-
 lib/splay.c                                        |   3 +-
 lib/ssh-libssh.c                                   |  27 +-
 lib/ssh.c                                          |   8 +-
 lib/telnet.c                                       |  51 +--
 lib/tftp.c                                         |  21 +-
 lib/transfer.c                                     |  10 +-
 lib/url.c                                          |  61 +--
 lib/urldata.h                                      |  16 +-
 lib/vauth/digest.c                                 |   6 +-
 lib/version.c                                      |   2 +-
 lib/vtls/axtls.c                                   |   5 +
 lib/vtls/cyassl.c                                  |   2 +-
 lib/vtls/darwinssl.c                               |  17 +-
 lib/vtls/gskit.c                                   |  32 +-
 lib/vtls/nss.c                                     |  11 +-
 lib/vtls/openssl.c                                 |  80 ++--
 lib/vtls/schannel.c                                | 188 ++++++++-
 lib/vtls/schannel.h                                |  34 ++
 lib/vtls/schannel_verify.c                         |  18 +-
 lib/vtls/vtls.c                                    |   8 +
 lib/vtls/vtls.h                                    |   5 +-
 lib/x509asn1.c                                     |   4 +-
 m4/ax_compile_check_sizeof.m4                      | 115 ++++++
 m4/curl-confopts.m4                                |  39 +-
 m4/curl-functions.m4                               |   3 +-
 maketgz                                            |  67 ++--
 packages/OS400/README.OS400                        |   8 +-
 packages/OS400/ccsidcurl.c                         |  79 ++++
 packages/OS400/ccsidcurl.h                         |  20 +-
 packages/OS400/curl.inc.in                         | 178 ++++++++-
 packages/OS400/os400sys.c                          |   2 +-
 packages/vms/build_gnv_curl_pcsi_desc.com          |   2 +-
 packages/vms/setup_gnv_curl_build.com              |   2 +-
 projects/build-openssl.bat                         |   2 +-
 projects/wolfssl_options.h                         |   2 +-
 scripts/Makefile.am                                |   2 +
 src/CMakeLists.txt                                 |   4 -
 src/Makefile.am                                    |   4 +-
 src/Makefile.b32                                   | 154 --------
 src/Makefile.m32                                   |   4 +-
 src/Makefile.netware                               |   4 +-
 src/curl.rc                                        |  50 ++-
 src/tool_cb_dbg.c                                  |  10 +-
 src/tool_cb_hdr.c                                  |  63 ++-
 src/tool_cb_hdr.h                                  |   4 +-
 src/tool_cb_prg.c                                  |  12 +-
 src/tool_cb_wrt.c                                  |  13 +-
 src/tool_cb_wrt.h                                  |   4 +-
 src/tool_cfgable.h                                 |   8 +-
 src/tool_formparse.c                               |  13 +-
 src/tool_getparam.c                                |  38 +-
 src/tool_help.c                                    |  20 +-
 src/tool_libinfo.c                                 |   2 +-
 src/tool_main.c                                    |   3 +-
 src/tool_metalink.c                                |   4 +-
 src/tool_msgs.c                                    |   2 +-
 src/tool_operate.c                                 |  25 +-
 src/tool_paramhlp.c                                |  10 +-
 src/tool_parsecfg.c                                |   8 +-
 src/tool_urlglob.c                                 |   2 +-
 src/tool_writeout.c                                |   4 +-
 tests/Makefile.am                                  |   4 +-
 tests/data/DISABLED                                |   2 -
 tests/data/Makefile.inc                            |   9 +-
 tests/data/test1116                                |   2 +
 tests/data/test1156                                |  70 ++++
 tests/data/test1319                                |   3 -
 tests/data/test1321                                |   3 -
 tests/data/test1400                                |   1 -
 tests/data/test1401                                |   1 -
 tests/data/test1402                                |   1 -
 tests/data/test1403                                |   1 -
 tests/data/test1404                                |   1 -
 tests/data/test1405                                |   1 -
 tests/data/test1406                                |   1 -
 tests/data/test1407                                |   1 -
 tests/data/test1417                                |   1 +
 tests/data/test1420                                |   1 -
 tests/data/test1455                                |   7 +-
 tests/data/test1553                                |   4 +-
 tests/data/{test507 => test1557}                   |  25 +-
 tests/data/{test1553 => test1590}                  |   6 +-
 tests/data/{test1607 => test1609}                  |   2 +-
 tests/data/test2010                                |   4 +-
 tests/data/{test1 => test2074}                     |   6 +-
 tests/data/{test2044 => test2075}                  |  13 +-
 tests/data/test266                                 |   1 +
 tests/data/test46                                  |   8 +-
 tests/data/test851                                 |   2 +-
 tests/data/test92                                  |  14 +
 tests/libtest/.gitignore                           |   8 +-
 tests/libtest/CMakeLists.txt                       |  12 +-
 tests/libtest/Makefile.am                          |   7 +-
 tests/libtest/Makefile.inc                         |  13 +-
 tests/libtest/lib1156.c                            | 162 ++++++++
 tests/libtest/lib1537.c                            |  15 +-
 tests/libtest/lib1554.c                            |   3 +-
 tests/libtest/{lib1508.c => lib1557.c}             |  33 +-
 tests/libtest/lib1900.c                            |   8 +-
 tests/libtest/lib500.c                             |  50 ++-
 tests/libtest/lib506.c                             |   2 +-
 tests/libtest/lib512.c                             |   6 +-
 tests/libtest/lib544.c                             |   2 +-
 tests/libtest/lib552.c                             |   4 +-
 tests/libtest/lib556.c                             |   2 +-
 tests/libtest/lib579.c                             |   3 +-
 tests/libtest/lib586.c                             |   2 +-
 tests/libtest/lib650.c                             |   4 +-
 tests/libtest/lib652.c                             |   4 +-
 tests/libtest/stub_gssapi.c                        |  52 ++-
 tests/libtest/testtrace.c                          |   2 +-
 tests/runtests.pl                                  |   1 +
 tests/server/CMakeLists.txt                        |   6 -
 tests/server/getpart.c                             |   2 +-
 tests/server/rtspd.c                               |  26 +-
 tests/server/sockfilt.c                            |  29 +-
 tests/server/sws.c                                 |  13 +-
 tests/server/testpart.c                            |   6 +-
 tests/server/tftpd.c                               |  16 +-
 tests/server/util.c                                |   5 +-
 tests/unit/Makefile.inc                            |   5 +-
 tests/unit/README                                  |   4 +-
 tests/unit/unit1300.c                              |   2 +-
 tests/unit/unit1303.c                              |   2 +-
 tests/unit/unit1307.c                              | 113 ++++--
 tests/unit/unit1604.c                              |   4 +-
 tests/unit/unit1607.c                              |  10 +-
 tests/unit/{unit1607.c => unit1609.c}              |  91 ++---
 winbuild/MakefileBuild.vc                          |   6 +-
 winbuild/gen_resp_file.bat                         |   4 +-
 306 files changed, 4050 insertions(+), 2543 deletions(-)
 create mode 100644 docs/DEPRECATE.md
 create mode 100644 docs/GOVERNANCE.md
 rename docs/{RELEASE-PROCEDURE => RELEASE-PROCEDURE.md} (92%)
 create mode 100644 docs/cmdline-opts/disallow-username-in-url.d
 create mode 100644 docs/cmdline-opts/proxy-tls13-ciphers.d
 create mode 100644 docs/cmdline-opts/styled-output.d
 create mode 100644 docs/cmdline-opts/tls13-ciphers.d
 create mode 100644 docs/examples/crawler.c
 copy docs/libcurl/opts/{GNURLINFO_APPCONNECT_TIME.3 => 
GNURLINFO_APPCONNECT_TIME_T.3} (73%)
 copy docs/libcurl/opts/{GNURLINFO_CONNECT_TIME.3 => 
GNURLINFO_CONNECT_TIME_T.3} (67%)
 copy docs/libcurl/opts/{GNURLINFO_NAMELOOKUP_TIME.3 => 
GNURLINFO_NAMELOOKUP_TIME_T.3} (69%)
 copy docs/libcurl/opts/{GNURLINFO_PRETRANSFER_TIME.3 => 
GNURLINFO_PRETRANSFER_TIME_T.3} (73%)
 copy docs/libcurl/opts/{GNURLINFO_REDIRECT_TIME.3 => 
GNURLINFO_REDIRECT_TIME_T.3} (65%)
 copy docs/libcurl/opts/{GNURLINFO_STARTTRANSFER_TIME.3 => 
GNURLINFO_STARTTRANSFER_TIME_T.3} (69%)
 copy docs/libcurl/opts/{GNURLINFO_CONNECT_TIME.3 => GNURLINFO_TOTAL_TIME_T.3} 
(66%)
 copy docs/libcurl/opts/{GNURLINFO_PRIMARY_PORT.3 => 
GNURLOPT_DISALLOW_USERNAME_IN_URL.3} (63%)
 copy docs/libcurl/opts/{GNURLOPT_SSLENGINE.3 => 
GNURLOPT_PROXY_TLS13_CIPHERS.3} (60%)
 copy docs/libcurl/opts/{GNURLOPT_EGDSOCKET.3 => GNURLOPT_TLS13_CIPHERS.3} (61%)
 delete mode 100644 lib/Makefile.b32
 create mode 100644 lib/psl.c
 copy src/tool_filetime.h => lib/psl.h (61%)
 create mode 100644 m4/ax_compile_check_sizeof.m4
 delete mode 100644 src/Makefile.b32
 create mode 100644 tests/data/test1156
 copy tests/data/{test507 => test1557} (52%)
 copy tests/data/{test1553 => test1590} (81%)
 copy tests/data/{test1607 => test1609} (96%)
 copy tests/data/{test1 => test2074} (82%)
 copy tests/data/{test2044 => test2075} (60%)
 create mode 100644 tests/libtest/lib1156.c
 copy tests/libtest/{lib1508.c => lib1557.c} (62%)
 copy tests/unit/{unit1607.c => unit1609.c} (73%)

diff --git a/.mailmap b/.mailmap
index 47859fb38..b1584e675 100644
--- a/.mailmap
+++ b/.mailmap
@@ -29,6 +29,7 @@ Anthony Bryan <address@hidden> <address@hidden>
 Travis Burtrum <address@hidden>
 Dmitry Kostjuchenko <address@hidden>
 Richard Alcock <address@hidden>
+Richard Alcock <address@hidden> <address@hidden>
 Jan Ehrhardt <address@hidden>
 Florin Petriuc <address@hidden> <address@hidden>
 Pavel Pavlov <address@hidden>
@@ -42,3 +43,4 @@ Henrik S. Gaßmann <address@hidden>
 Jiří Malák <address@hidden>
 Nick Zitzmann <address@hidden>
 Kees Dekker <address@hidden>
+Max Savenkov <address@hidden>
diff --git a/.travis.yml b/.travis.yml
index 6952f704f..0045c5e0b 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -34,7 +34,7 @@ addons:
             - libssh-dev
             - krb5-user
             - autopoint  # for libpsl that needs autoreconf that uses gettext 
that needs it
-            - libunistring-dev # for libidn2 neeed by libpsl
+            - libunistring-dev # for libidn2 needed by libpsl
             - libnss3-dev
 
 matrix:
@@ -78,6 +78,10 @@ matrix:
         - os: linux
           compiler: clang
           dist: trusty
+          env: T=debug C="--disable-threaded-resolver"
+        - os: linux
+          compiler: clang
+          dist: trusty
           env: T=debug C="--with-nss --without-ssl" NOTESTS=1 
CPPFLAGS="-isystem /usr/include/nss"
         - os: linux
           compiler: gcc
@@ -230,8 +234,8 @@ script:
              ./configure --enable-debug --disable-shared --enable-code-coverage
              make
              make TFLAGS=-n test-nonflaky
-             tests="1 2 3 4 5 6 7 8 9 10 200 201 202 300 301 302 500 501 502 
503 504 506 507 508 509 510 511 512 513 514 515 516 517 518 519 600 601 800 801 
802 803 900 901 902 903 1000 1001 1002 1004 1302 1303 1304 1305 1306 1308 1400 
1401 1402 1404 1450 1451 1452 1502 1507 1508 1600 1602 1603 1605"
-             make "TFLAGS=-n -e $tests" test-nonflaky
+             make "TFLAGS=-n -e" test-nonflaky
+             tests="1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 200 201 
202 300 301 302 500 501 502 503 504 506 507 508 509 510 511 512 513 514 515 516 
517 518 519 600 601 700 701 702 800 801 802 803 900 901 902 903 1000 1001 1002 
1004 1100 1101 1200 1201 1302 1303 1304 1305 1306 1308 1400 1401 1402 1404 1450 
1451 1452 1502 1507 1508 1600 1602 1603 1605 1700 1701 1702 2001 3000"
              make "TFLAGS=-n -t $tests" test-nonflaky
              coveralls --gcov /usr/bin/gcov-7 --gcov-options '\-lp' -i src -e 
lib -e tests -e docs -b $PWD/src
              coveralls --gcov /usr/bin/gcov-7 --gcov-options '\-lp' -e src -i 
lib -e tests -e docs -b $PWD/lib
diff --git a/CMake/CurlTests.c b/CMake/CurlTests.c
index bc36c8ef7..ab244ac39 100644
--- a/CMake/CurlTests.c
+++ b/CMake/CurlTests.c
@@ -507,30 +507,30 @@ main ()
 #ifdef HAVE_GLIBC_STRERROR_R
 #include <string.h>
 #include <errno.h>
+
+void check(char c) {}
+
 int
 main () {
-  char buffer[1024]; /* big enough to play with */
-  char *string =
-    strerror_r(EACCES, buffer, sizeof(buffer));
-    /* this should've returned a string */
-    if(!string || !string[0])
-      return 99;
-    return 0;
+  char buffer[1024];
+  /* This will not compile if strerror_r does not return a char* */
+  check(strerror_r(EACCES, buffer, sizeof(buffer))[0]);
+  return 0;
 }
 #endif
 #ifdef HAVE_POSIX_STRERROR_R
 #include <string.h>
 #include <errno.h>
+
+/* float, because a pointer can't be implicitly cast to float */
+void check(float f) {}
+
 int
 main () {
-  char buffer[1024]; /* big enough to play with */
-  int error =
-    strerror_r(EACCES, buffer, sizeof(buffer));
-    /* This should've returned zero, and written an error string in the
-       buffer.*/
-    if(!buffer[0] || error)
-      return 99;
-    return 0;
+  char buffer[1024];
+  /* This will not compile if strerror_r does not return an int */
+  check(strerror_r(EACCES, buffer, sizeof(buffer)));
+  return 0;
 }
 #endif
 #ifdef HAVE_FSETXATTR_6
diff --git a/CMake/Macros.cmake b/CMake/Macros.cmake
index 82aadca9d..87bf905f2 100644
--- a/CMake/Macros.cmake
+++ b/CMake/Macros.cmake
@@ -10,8 +10,8 @@ macro(CHECK_LIBRARY_EXISTS_CONCAT LIBRARY SYMBOL VARIABLE)
     ${VARIABLE})
   if(${VARIABLE})
     set(CURL_LIBS ${LIBRARY} ${CURL_LIBS})
-  endif(${VARIABLE})
-endmacro(CHECK_LIBRARY_EXISTS_CONCAT)
+  endif()
+endmacro()
 
 # Check if header file exists and add it to the list.
 # This macro is intended to be called multiple times with a sequence of
@@ -22,8 +22,8 @@ macro(CHECK_INCLUDE_FILE_CONCAT FILE VARIABLE)
   if(${VARIABLE})
     set(CURL_INCLUDES ${CURL_INCLUDES} ${FILE})
     set(CURL_TEST_DEFINES "${CURL_TEST_DEFINES} -D${VARIABLE}")
-  endif(${VARIABLE})
-endmacro(CHECK_INCLUDE_FILE_CONCAT)
+  endif()
+endmacro()
 
 # For other curl specific tests, use this macro.
 macro(CURL_INTERNAL_TEST CURL_TEST)
@@ -33,7 +33,7 @@ macro(CURL_INTERNAL_TEST CURL_TEST)
     if(CMAKE_REQUIRED_LIBRARIES)
       set(CURL_TEST_ADD_LIBRARIES
         "-DLINK_LIBRARIES:STRING=${CMAKE_REQUIRED_LIBRARIES}")
-    endif(CMAKE_REQUIRED_LIBRARIES)
+    endif()
 
     message(STATUS "Performing Curl Test ${CURL_TEST}")
     try_compile(${CURL_TEST}
@@ -48,15 +48,15 @@ macro(CURL_INTERNAL_TEST CURL_TEST)
       file(APPEND ${CMAKE_BINARY_DIR}${CMAKE_FILES_DIRECTORY}/CMakeOutput.log
         "Performing Curl Test ${CURL_TEST} passed with the following output:\n"
         "${OUTPUT}\n")
-    else(${CURL_TEST})
+    else()
       message(STATUS "Performing Curl Test ${CURL_TEST} - Failed")
       set(${CURL_TEST} "" CACHE INTERNAL "Curl test ${FUNCTION}")
       file(APPEND ${CMAKE_BINARY_DIR}${CMAKE_FILES_DIRECTORY}/CMakeError.log
         "Performing Curl Test ${CURL_TEST} failed with the following output:\n"
         "${OUTPUT}\n")
-    endif(${CURL_TEST})
+    endif()
   endif()
-endmacro(CURL_INTERNAL_TEST)
+endmacro()
 
 macro(CURL_INTERNAL_TEST_RUN CURL_TEST)
   if(NOT DEFINED "${CURL_TEST}_COMPILE")
@@ -65,7 +65,7 @@ macro(CURL_INTERNAL_TEST_RUN CURL_TEST)
     if(CMAKE_REQUIRED_LIBRARIES)
       set(CURL_TEST_ADD_LIBRARIES
         "-DLINK_LIBRARIES:STRING=${CMAKE_REQUIRED_LIBRARIES}")
-    endif(CMAKE_REQUIRED_LIBRARIES)
+    endif()
 
     message(STATUS "Performing Curl Test ${CURL_TEST}")
     try_run(${CURL_TEST} ${CURL_TEST}_COMPILE
@@ -77,7 +77,7 @@ macro(CURL_INTERNAL_TEST_RUN CURL_TEST)
     if(${CURL_TEST}_COMPILE AND NOT ${CURL_TEST})
       set(${CURL_TEST} 1 CACHE INTERNAL "Curl test ${FUNCTION}")
       message(STATUS "Performing Curl Test ${CURL_TEST} - Success")
-    else(${CURL_TEST}_COMPILE AND NOT ${CURL_TEST})
+    else()
       message(STATUS "Performing Curl Test ${CURL_TEST} - Failed")
       set(${CURL_TEST} "" CACHE INTERNAL "Curl test ${FUNCTION}")
       file(APPEND "${CMAKE_BINARY_DIR}${CMAKE_FILES_DIRECTORY}/CMakeError.log"
@@ -87,12 +87,12 @@ macro(CURL_INTERNAL_TEST_RUN CURL_TEST)
         file(APPEND
           "${CMAKE_BINARY_DIR}${CMAKE_FILES_DIRECTORY}/CMakeError.log"
           "There was a problem running this test\n")
-      endif(${CURL_TEST}_COMPILE)
+      endif()
       file(APPEND "${CMAKE_BINARY_DIR}${CMAKE_FILES_DIRECTORY}/CMakeError.log"
         "\n\n")
-    endif(${CURL_TEST}_COMPILE AND NOT ${CURL_TEST})
+    endif()
   endif()
-endmacro(CURL_INTERNAL_TEST_RUN)
+endmacro()
 
 macro(CURL_NROFF_CHECK)
   find_program(NROFF NAMES gnroff nroff)
@@ -121,4 +121,4 @@ macro(CURL_NROFF_CHECK)
   else()
     message(WARNING "Found no *nroff program")
   endif()
-endmacro(CURL_NROFF_CHECK)
+endmacro()
diff --git a/CMake/OtherTests.cmake b/CMake/OtherTests.cmake
index 989f04eb2..ce6d3e13a 100644
--- a/CMake/OtherTests.cmake
+++ b/CMake/OtherTests.cmake
@@ -5,8 +5,8 @@ set(_source_epilogue "#undef inline")
 macro(add_header_include check header)
   if(${check})
     set(_source_epilogue "${_source_epilogue}\n#include <${header}>")
-  endif(${check})
-endmacro(add_header_include)
+  endif()
+endmacro()
 
 set(signature_call_conv)
 if(HAVE_WINDOWS_H)
@@ -19,10 +19,10 @@ if(HAVE_WINDOWS_H)
   if(HAVE_LIBWS2_32)
     set(CMAKE_REQUIRED_LIBRARIES ws2_32)
   endif()
-else(HAVE_WINDOWS_H)
+else()
   add_header_include(HAVE_SYS_TYPES_H "sys/types.h")
   add_header_include(HAVE_SYS_SOCKET_H "sys/socket.h")
-endif(HAVE_WINDOWS_H)
+endif()
 
 check_c_source_compiles("${_source_epilogue}
 int main(void) {
@@ -64,13 +64,13 @@ if(curl_cv_recv)
                   set(RECV_TYPE_RETV "${recv_retv}")
                   set(HAVE_RECV 1)
                   set(curl_cv_func_recv_done 1)
-                endif(curl_cv_func_recv_test)
-              endif(NOT curl_cv_func_recv_done)
-            endforeach(recv_arg4)
-          endforeach(recv_arg3)
-        endforeach(recv_arg2)
-      endforeach(recv_arg1)
-    endforeach(recv_retv)
+                endif()
+              endif()
+            endforeach()
+          endforeach()
+        endforeach()
+      endforeach()
+    endforeach()
   else()
     string(REGEX REPLACE "^([^,]*),[^,]*,[^,]*,[^,]*,[^,]*$" "\\1" 
RECV_TYPE_ARG1 "${curl_cv_func_recv_args}")
     string(REGEX REPLACE "^[^,]*,([^,]*),[^,]*,[^,]*,[^,]*$" "\\1" 
RECV_TYPE_ARG2 "${curl_cv_func_recv_args}")
@@ -81,10 +81,10 @@ if(curl_cv_recv)
 
   if("${curl_cv_func_recv_args}" STREQUAL "unknown")
     message(FATAL_ERROR "Cannot find proper types to use for recv args")
-  endif("${curl_cv_func_recv_args}" STREQUAL "unknown")
-else(curl_cv_recv)
+  endif()
+else()
   message(FATAL_ERROR "Unable to link function recv")
-endif(curl_cv_recv)
+endif()
 set(curl_cv_func_recv_args "${curl_cv_func_recv_args}" CACHE INTERNAL 
"Arguments for recv")
 set(HAVE_RECV 1)
 
@@ -130,13 +130,13 @@ if(curl_cv_send)
                   set(SEND_TYPE_RETV "${send_retv}")
                   set(HAVE_SEND 1)
                   set(curl_cv_func_send_done 1)
-                endif(curl_cv_func_send_test)
-              endif(NOT curl_cv_func_send_done)
-            endforeach(send_arg4)
-          endforeach(send_arg3)
-        endforeach(send_arg2)
-      endforeach(send_arg1)
-    endforeach(send_retv)
+                endif()
+              endif()
+            endforeach()
+          endforeach()
+        endforeach()
+      endforeach()
+    endforeach()
   else()
     string(REGEX REPLACE "^([^,]*),[^,]*,[^,]*,[^,]*,[^,]*,[^,]*$" "\\1" 
SEND_TYPE_ARG1 "${curl_cv_func_send_args}")
     string(REGEX REPLACE "^[^,]*,([^,]*),[^,]*,[^,]*,[^,]*,[^,]*$" "\\1" 
SEND_TYPE_ARG2 "${curl_cv_func_send_args}")
@@ -148,11 +148,11 @@ if(curl_cv_send)
 
   if("${curl_cv_func_send_args}" STREQUAL "unknown")
     message(FATAL_ERROR "Cannot find proper types to use for send args")
-  endif("${curl_cv_func_send_args}" STREQUAL "unknown")
+  endif()
   set(SEND_QUAL_ARG2 "const")
-else(curl_cv_send)
+else()
   message(FATAL_ERROR "Unable to link function send")
-endif(curl_cv_send)
+endif()
 set(curl_cv_func_send_args "${curl_cv_func_send_args}" CACHE INTERNAL 
"Arguments for send")
 set(HAVE_SEND 1)
 
@@ -184,7 +184,7 @@ if(NOT APPLE)
   set(CMAKE_REQUIRED_FLAGS)
   if(HAVE_SYS_POLL_H)
     set(CMAKE_REQUIRED_FLAGS "-DHAVE_SYS_POLL_H")
-  endif(HAVE_SYS_POLL_H)
+  endif()
   check_c_source_runs("
     #ifdef HAVE_SYS_POLL_H
     #  include <sys/poll.h>
@@ -199,7 +199,7 @@ set(CMAKE_REQUIRED_FLAGS)
 if(HAVE_SIGNAL_H)
   set(CMAKE_REQUIRED_FLAGS "-DHAVE_SIGNAL_H")
   set(CMAKE_EXTRA_INCLUDE_FILES "signal.h")
-endif(HAVE_SIGNAL_H)
+endif()
 check_type_size("sig_atomic_t" SIZEOF_SIG_ATOMIC_T)
 if(HAVE_SIZEOF_SIG_ATOMIC_T)
   check_c_source_compiles("
@@ -213,8 +213,8 @@ if(HAVE_SIZEOF_SIG_ATOMIC_T)
     }" HAVE_SIG_ATOMIC_T_NOT_VOLATILE)
   if(NOT HAVE_SIG_ATOMIC_T_NOT_VOLATILE)
     set(HAVE_SIG_ATOMIC_T_VOLATILE 1)
-  endif(NOT HAVE_SIG_ATOMIC_T_NOT_VOLATILE)
-endif(HAVE_SIZEOF_SIG_ATOMIC_T)
+  endif()
+endif()
 
 if(HAVE_WINDOWS_H)
   set(CMAKE_EXTRA_INCLUDE_FILES winsock2.h)
@@ -222,11 +222,10 @@ else()
   set(CMAKE_EXTRA_INCLUDE_FILES)
   if(HAVE_SYS_SOCKET_H)
     set(CMAKE_EXTRA_INCLUDE_FILES sys/socket.h)
-  endif(HAVE_SYS_SOCKET_H)
+  endif()
 endif()
 
 check_type_size("struct sockaddr_storage" SIZEOF_STRUCT_SOCKADDR_STORAGE)
 if(HAVE_SIZEOF_STRUCT_SOCKADDR_STORAGE)
   set(HAVE_STRUCT_SOCKADDR_STORAGE 1)
-endif(HAVE_SIZEOF_STRUCT_SOCKADDR_STORAGE)
-
+endif()
diff --git a/CMake/Platforms/WindowsCache.cmake 
b/CMake/Platforms/WindowsCache.cmake
index 6fc2991cd..cafaec216 100644
--- a/CMake/Platforms/WindowsCache.cmake
+++ b/CMake/Platforms/WindowsCache.cmake
@@ -118,8 +118,7 @@ if(NOT UNIX)
 
     set(HAVE_SIGACTION 0)
     set(HAVE_MACRO_SIGSETJMP 0)
-  else(WIN32)
+  else()
     message("This file should be included on Windows platform only")
-  endif(WIN32)
-endif(NOT UNIX)
-
+  endif()
+endif()
diff --git a/CMake/Utilities.cmake b/CMake/Utilities.cmake
index 005b166ff..5cb1d4497 100644
--- a/CMake/Utilities.cmake
+++ b/CMake/Utilities.cmake
@@ -1,44 +1,13 @@
 # File containing various utilities
 
-# Converts a CMake list to a string containing elements separated by spaces
-function(TO_LIST_SPACES _LIST_NAME OUTPUT_VAR)
-  set(NEW_LIST_SPACE)
-  foreach(ITEM ${${_LIST_NAME}})
-    set(NEW_LIST_SPACE "${NEW_LIST_SPACE} ${ITEM}")
-  endforeach()
-  string(STRIP ${NEW_LIST_SPACE} NEW_LIST_SPACE)
-  set(${OUTPUT_VAR} "${NEW_LIST_SPACE}" PARENT_SCOPE)
-endfunction()
-
-# Appends a lis of item to a string which is a space-separated list, if they 
don't already exist.
-function(LIST_SPACES_APPEND_ONCE LIST_NAME)
-  string(REPLACE " " ";" _LIST ${${LIST_NAME}})
-  list(APPEND _LIST ${ARGN})
-  list(REMOVE_DUPLICATES _LIST)
-  to_list_spaces(_LIST NEW_LIST_SPACE)
-  set(${LIST_NAME} "${NEW_LIST_SPACE}" PARENT_SCOPE)
-endfunction()
-
-# Convenience function that does the same as LIST(FIND ...) but with a 
TRUE/FALSE return value.
-# Ex: IN_STR_LIST(MY_LIST "Searched item" WAS_FOUND)
-function(IN_STR_LIST LIST_NAME ITEM_SEARCHED RETVAL)
-  list(FIND ${LIST_NAME} ${ITEM_SEARCHED} FIND_POS)
-  if(${FIND_POS} EQUAL -1)
-    set(${RETVAL} FALSE PARENT_SCOPE)
-  else()
-    set(${RETVAL} TRUE PARENT_SCOPE)
-  endif()
-endfunction()
-
 # Returns a list of arguments that evaluate to true
-function(collect_true output_var output_count_var)
-  set(${output_var})
+function(count_true output_count_var)
+  set(lst)
   foreach(option_var IN LISTS ARGN)
     if(${option_var})
-      list(APPEND ${output_var} ${option_var})
+      list(APPEND lst ${option_var})
     endif()
   endforeach()
-  set(${output_var} ${${output_var}} PARENT_SCOPE)
-  list(LENGTH ${output_var} ${output_count_var})
-  set(${output_count_var} ${${output_count_var}} PARENT_SCOPE)
+  list(LENGTH lst lst_len)
+  set(${output_count_var} ${lst_len} PARENT_SCOPE)
 endfunction()
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 00ae46a7f..69a0e18b2 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -100,8 +100,8 @@ if(CMAKE_COMPILER_IS_GNUCC OR CMAKE_COMPILER_IS_CLANG)
         set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${_CCOPT}")
       endif()
     endforeach()
-  endif(PICKY_COMPILER)
-endif(CMAKE_COMPILER_IS_GNUCC OR CMAKE_COMPILER_IS_CLANG)
+  endif()
+endif()
 
 if (ENABLE_DEBUG)
   # DEBUGBUILD will be defined only for Debug builds
@@ -118,7 +118,9 @@ if (ENABLE_CURLDEBUG)
 endif()
 
 # For debug libs and exes, add "-d" postfix
-set(CMAKE_DEBUG_POSTFIX "-d" CACHE STRING "Set debug library postfix")
+if(NOT DEFINED CMAKE_DEBUG_POSTFIX)
+  set(CMAKE_DEBUG_POSTFIX "-d")
+endif()
 
 # initialize CURL_LIBS
 set(CURL_LIBS "")
@@ -230,12 +232,12 @@ endif()
 # Disable warnings on Borland to avoid changing 3rd party code.
 if(BORLAND)
   set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -w-")
-endif(BORLAND)
+endif()
 
 # If we are on AIX, do the _ALL_SOURCE magic
 if(${CMAKE_SYSTEM_NAME} MATCHES AIX)
   set(_ALL_SOURCE 1)
-endif(${CMAKE_SYSTEM_NAME} MATCHES AIX)
+endif()
 
 # Include all the necessary files for macros
 include (CheckFunctionExists)
@@ -251,7 +253,7 @@ include (CMakeDependentOption)
 if(WIN32)
   set(CMAKE_REQUIRED_DEFINITIONS "${CMAKE_REQUIRED_DEFINITIONS} 
-D_WINSOCKAPI_=")
   include(${CMAKE_CURRENT_SOURCE_DIR}/CMake/Platforms/WindowsCache.cmake)
-endif(WIN32)
+endif()
 
 if(ENABLE_THREADED_RESOLVER)
   find_package(Threads REQUIRED)
@@ -274,11 +276,11 @@ if(BEOS)
   set(NOT_NEED_LIBNSL 1)
   check_library_exists_concat("bind" gethostbyname HAVE_LIBBIND)
   check_library_exists_concat("bnetapi" closesocket HAVE_LIBBNETAPI)
-endif(BEOS)
+endif()
 
 if(NOT NOT_NEED_LIBNSL)
   check_library_exists_concat("nsl"    gethostbyname  HAVE_LIBNSL)
-endif(NOT NOT_NEED_LIBNSL)
+endif()
 
 check_function_exists(gethostname HAVE_GETHOSTNAME)
 
@@ -307,14 +309,14 @@ if(WIN32 OR CMAKE_USE_DARWINSSL OR CMAKE_USE_WINSSL OR 
CMAKE_USE_MBEDTLS)
 endif()
 option(CMAKE_USE_OPENSSL "Use OpenSSL code. Experimental" ${openssl_default})
 
-collect_true(enabled_ssl_options enabled_ssl_options_count
+count_true(enabled_ssl_options_count
   CMAKE_USE_WINSSL
   CMAKE_USE_DARWINSSL
   CMAKE_USE_OPENSSL
   CMAKE_USE_MBEDTLS
 )
-if(enabled_ssl_options_count GREATER 1)
-  message(FATAL_ERROR "Multiple SSL options specified: ${enabled_ssl_options}. 
Please pick at most one and disable the rest.")
+if(enabled_ssl_options_count GREATER "1")
+  set(CURL_WITH_MULTI_SSL ON)
 endif()
 
 if(CMAKE_USE_WINSSL)
@@ -354,7 +356,6 @@ if(CMAKE_USE_OPENSSL)
   include_directories(${OPENSSL_INCLUDE_DIR})
   set(CMAKE_REQUIRED_INCLUDES ${OPENSSL_INCLUDE_DIR})
   check_include_file("openssl/crypto.h" HAVE_OPENSSL_CRYPTO_H)
-  check_include_file("openssl/engine.h" HAVE_OPENSSL_ENGINE_H)
   check_include_file("openssl/err.h"    HAVE_OPENSSL_ERR_H)
   check_include_file("openssl/pem.h"    HAVE_OPENSSL_PEM_H)
   check_include_file("openssl/rsa.h"    HAVE_OPENSSL_RSA_H)
@@ -554,9 +555,8 @@ if(CMAKE_USE_LIBSSH2)
     check_function_exists(libssh2_scp_send64        HAVE_LIBSSH2_SCP_SEND64)
     check_function_exists(libssh2_session_handshake 
HAVE_LIBSSH2_SESSION_HANDSHAKE)
     set(CMAKE_EXTRA_INCLUDE_FILES "")
-
-  endif(LIBSSH2_FOUND)
-endif(CMAKE_USE_LIBSSH2)
+  endif()
+endif()
 
 option(CMAKE_USE_GSSAPI "Use GSSAPI implementation (right now only Heimdal is 
supported with CMake build)" OFF)
 mark_as_advanced(CMAKE_USE_GSSAPI)
@@ -707,7 +707,7 @@ if(NOT UNIX)
   if(NOT CURL_WINDOWS_SSPI AND USE_OPENSSL)
     set(CURL_LIBS ${CURL_LIBS} "crypt32")
   endif()
-endif(NOT UNIX)
+endif()
 
 check_include_file_concat("stdio.h"          HAVE_STDIO_H)
 check_include_file_concat("inttypes.h"       HAVE_INTTYPES_H)
@@ -790,17 +790,17 @@ check_type_size("time_t"  SIZEOF_TIME_T)
 if(NOT HAVE_SIZEOF_SSIZE_T)
   if(SIZEOF_LONG EQUAL SIZEOF_SIZE_T)
     set(ssize_t long)
-  endif(SIZEOF_LONG EQUAL SIZEOF_SIZE_T)
+  endif()
   if(NOT ssize_t AND SIZEOF___INT64 EQUAL SIZEOF_SIZE_T)
     set(ssize_t __int64)
-  endif(NOT ssize_t AND SIZEOF___INT64 EQUAL SIZEOF_SIZE_T)
-endif(NOT HAVE_SIZEOF_SSIZE_T)
+  endif()
+endif()
 # off_t is sized later, after the HAVE_FILE_OFFSET_BITS test
 
 if(HAVE_SIZEOF_LONG_LONG)
   set(HAVE_LONGLONG 1)
   set(HAVE_LL 1)
-endif(HAVE_SIZEOF_LONG_LONG)
+endif()
 
 find_file(RANDOM_FILE urandom /dev)
 mark_as_advanced(RANDOM_FILE)
@@ -832,7 +832,7 @@ check_symbol_exists(strncmpi      "${CURL_INCLUDES}" 
HAVE_STRNCMPI)
 check_symbol_exists(alarm         "${CURL_INCLUDES}" HAVE_ALARM)
 if(NOT HAVE_STRNCMPI)
   set(HAVE_STRCMPI)
-endif(NOT HAVE_STRNCMPI)
+endif()
 check_symbol_exists(gethostbyaddr "${CURL_INCLUDES}" HAVE_GETHOSTBYADDR)
 check_symbol_exists(gethostbyaddr_r "${CURL_INCLUDES}" HAVE_GETHOSTBYADDR_R)
 check_symbol_exists(gettimeofday  "${CURL_INCLUDES}" HAVE_GETTIMEOFDAY)
@@ -848,6 +848,7 @@ check_symbol_exists(sigsetjmp     "${CURL_INCLUDES}" 
HAVE_SIGSETJMP)
 check_symbol_exists(getpass_r     "${CURL_INCLUDES}" HAVE_GETPASS_R)
 check_symbol_exists(strlcat       "${CURL_INCLUDES}" HAVE_STRLCAT)
 check_symbol_exists(getpwuid      "${CURL_INCLUDES}" HAVE_GETPWUID)
+check_symbol_exists(getpwuid_r    "${CURL_INCLUDES}" HAVE_GETPWUID_R)
 check_symbol_exists(geteuid       "${CURL_INCLUDES}" HAVE_GETEUID)
 check_symbol_exists(utime         "${CURL_INCLUDES}" HAVE_UTIME)
 check_symbol_exists(gmtime_r      "${CURL_INCLUDES}" HAVE_GMTIME_R)
@@ -860,7 +861,7 @@ check_symbol_exists(signal        "${CURL_INCLUDES}" 
HAVE_SIGNAL_FUNC)
 check_symbol_exists(SIGALRM       "${CURL_INCLUDES}" HAVE_SIGNAL_MACRO)
 if(HAVE_SIGNAL_FUNC AND HAVE_SIGNAL_MACRO)
   set(HAVE_SIGNAL 1)
-endif(HAVE_SIGNAL_FUNC AND HAVE_SIGNAL_MACRO)
+endif()
 check_symbol_exists(uname          "${CURL_INCLUDES}" HAVE_UNAME)
 check_symbol_exists(strtoll        "${CURL_INCLUDES}" HAVE_STRTOLL)
 check_symbol_exists(_strtoi64      "${CURL_INCLUDES}" HAVE__STRTOI64)
@@ -900,29 +901,29 @@ endif()
 check_symbol_exists(fsetxattr "${CURL_INCLUDES}" HAVE_FSETXATTR)
 if(HAVE_FSETXATTR)
   foreach(CURL_TEST HAVE_FSETXATTR_5 HAVE_FSETXATTR_6)
-    curl_internal_test_run(${CURL_TEST})
-  endforeach(CURL_TEST)
-endif(HAVE_FSETXATTR)
+    curl_internal_test(${CURL_TEST})
+  endforeach()
+endif()
 
 # sigaction and sigsetjmp are special. Use special mechanism for
 # detecting those, but only if previous attempt failed.
 if(HAVE_SIGNAL_H)
   check_symbol_exists(sigaction "signal.h" HAVE_SIGACTION)
-endif(HAVE_SIGNAL_H)
+endif()
 
 if(NOT HAVE_SIGSETJMP)
   if(HAVE_SETJMP_H)
     check_symbol_exists(sigsetjmp "setjmp.h" HAVE_MACRO_SIGSETJMP)
     if(HAVE_MACRO_SIGSETJMP)
       set(HAVE_SIGSETJMP 1)
-    endif(HAVE_MACRO_SIGSETJMP)
-  endif(HAVE_SETJMP_H)
-endif(NOT HAVE_SIGSETJMP)
+    endif()
+  endif()
+endif()
 
 # If there is no stricmp(), do not allow LDAP to parse URLs
 if(NOT HAVE_STRICMP)
   set(HAVE_LDAP_URL_PARSE 1)
-endif(NOT HAVE_STRICMP)
+endif()
 
 # Do curl specific tests
 foreach(CURL_TEST
@@ -960,12 +961,12 @@ foreach(CURL_TEST
     HAVE_FILE_OFFSET_BITS
     )
   curl_internal_test(${CURL_TEST})
-endforeach(CURL_TEST)
+endforeach()
 
 if(HAVE_FILE_OFFSET_BITS)
   set(_FILE_OFFSET_BITS 64)
   set(CMAKE_REQUIRED_FLAGS "-D_FILE_OFFSET_BITS=64")
-endif(HAVE_FILE_OFFSET_BITS)
+endif()
 check_type_size("off_t"  SIZEOF_OFF_T)
 
 # include this header to get the type
@@ -980,8 +981,8 @@ foreach(CURL_TEST
     HAVE_GLIBC_STRERROR_R
     HAVE_POSIX_STRERROR_R
     )
-  curl_internal_test_run(${CURL_TEST})
-endforeach(CURL_TEST)
+  curl_internal_test(${CURL_TEST})
+endforeach()
 
 # Check for reentrant
 foreach(CURL_TEST
@@ -995,9 +996,9 @@ foreach(CURL_TEST
   if(NOT ${CURL_TEST})
     if(${CURL_TEST}_REENTRANT)
       set(NEED_REENTRANT 1)
-    endif(${CURL_TEST}_REENTRANT)
-  endif(NOT ${CURL_TEST})
-endforeach(CURL_TEST)
+    endif()
+  endif()
+endforeach()
 
 if(NEED_REENTRANT)
   foreach(CURL_TEST
@@ -1010,32 +1011,32 @@ if(NEED_REENTRANT)
     set(${CURL_TEST} 0)
     if(${CURL_TEST}_REENTRANT)
       set(${CURL_TEST} 1)
-    endif(${CURL_TEST}_REENTRANT)
-  endforeach(CURL_TEST)
-endif(NEED_REENTRANT)
+    endif()
+  endforeach()
+endif()
 
 if(HAVE_INET_NTOA_R_DECL_REENTRANT)
   set(HAVE_INET_NTOA_R_DECL 1)
   set(NEED_REENTRANT 1)
-endif(HAVE_INET_NTOA_R_DECL_REENTRANT)
+endif()
 
 # Some other minor tests
 
 if(NOT HAVE_IN_ADDR_T)
   set(in_addr_t "unsigned long")
-endif(NOT HAVE_IN_ADDR_T)
+endif()
 
 # Fix libz / zlib.h
 
 if(NOT CURL_SPECIAL_LIBZ)
   if(NOT HAVE_LIBZ)
     set(HAVE_ZLIB_H 0)
-  endif(NOT HAVE_LIBZ)
+  endif()
 
   if(NOT HAVE_ZLIB_H)
     set(HAVE_LIBZ 0)
-  endif(NOT HAVE_ZLIB_H)
-endif(NOT CURL_SPECIAL_LIBZ)
+  endif()
+endif()
 
 # Check for nonblocking
 set(HAVE_DISABLED_NONBLOCKING 1)
@@ -1044,16 +1045,13 @@ if(HAVE_FIONBIO OR
     HAVE_IOCTLSOCKET_CASE OR
     HAVE_O_NONBLOCK)
   set(HAVE_DISABLED_NONBLOCKING)
-endif(HAVE_FIONBIO OR
-  HAVE_IOCTLSOCKET OR
-  HAVE_IOCTLSOCKET_CASE OR
-  HAVE_O_NONBLOCK)
+endif()
 
 if(RETSIGTYPE_TEST)
   set(RETSIGTYPE void)
-else(RETSIGTYPE_TEST)
+else()
   set(RETSIGTYPE int)
-endif(RETSIGTYPE_TEST)
+endif()
 
 if(CMAKE_COMPILER_IS_GNUCC AND APPLE)
   include(CheckCCompilerFlag)
@@ -1063,13 +1061,13 @@ if(CMAKE_COMPILER_IS_GNUCC AND APPLE)
     get_source_file_property(MPRINTF_COMPILE_FLAGS mprintf.c COMPILE_FLAGS)
     if(MPRINTF_COMPILE_FLAGS)
       set(MPRINTF_COMPILE_FLAGS "${MPRINTF_COMPILE_FLAGS} -Wno-long-double")
-    else(MPRINTF_COMPILE_FLAGS)
+    else()
       set(MPRINTF_COMPILE_FLAGS "-Wno-long-double")
-    endif(MPRINTF_COMPILE_FLAGS)
+    endif()
     set_source_files_properties(mprintf.c PROPERTIES
       COMPILE_FLAGS ${MPRINTF_COMPILE_FLAGS})
-  endif(HAVE_C_FLAG_Wno_long_double)
-endif(CMAKE_COMPILER_IS_GNUCC AND APPLE)
+  endif()
+endif()
 
 if(HAVE_SOCKLEN_T)
   set(CURL_TYPEOF_CURL_SOCKLEN_T "socklen_t")
@@ -1104,19 +1102,25 @@ include(CMake/OtherTests.cmake)
 
 add_definitions(-DHAVE_CONFIG_H)
 
-# For windows, all compilers used by cmake should support large files
+# For Windows, all compilers used by CMake should support large files
 if(WIN32)
   set(USE_WIN32_LARGE_FILES ON)
-endif(WIN32)
+
+  # Use the manifest embedded in the Windows Resource
+  set(CMAKE_RC_FLAGS "${CMAKE_RC_FLAGS} -DCURL_EMBED_MANIFEST")
+endif()
 
 if(MSVC)
+  # Disable default manifest added by CMake
+  set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} /MANIFEST:NO")
+
   add_definitions(-D_CRT_SECURE_NO_DEPRECATE -D_CRT_NONSTDC_NO_DEPRECATE)
   if(CMAKE_C_FLAGS MATCHES "/W[0-4]")
     string(REGEX REPLACE "/W[0-4]" "/W4" CMAKE_C_FLAGS "${CMAKE_C_FLAGS}")
-  else(CMAKE_C_FLAGS MATCHES "/W[0-4]")
+  else()
     set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} /W4")
-  endif(CMAKE_C_FLAGS MATCHES "/W[0-4]")
-endif(MSVC)
+  endif()
+endif()
 
 if(CURL_WERROR)
   if(MSVC_VERSION)
@@ -1125,7 +1129,7 @@ if(CURL_WERROR)
     # this assumes clang or gcc style options
     set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Werror")
   endif()
-endif(CURL_WERROR)
+endif()
 
 # Ugly (but functional) way to include "Makefile.inc" by transforming it (= 
regenerate it).
 function(TRANSFORM_MAKEFILE_INC INPUT_FILE OUTPUT_FILE)
diff --git a/Makefile.dist b/Makefile.dist
index 8577c8a14..a6316ab5f 100644
--- a/Makefile.dist
+++ b/Makefile.dist
@@ -5,7 +5,7 @@
 #                            | (__| |_| |  _ <| |___
 #                             \___|\___/|_| \_\_____|
 #
-# Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+# Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
 #
 # This software is licensed as described in the file COPYING, which
 # you should have received as part of this distribution. The terms
@@ -28,30 +28,6 @@ ssl:
        ./configure --with-ssl
        make
 
-borland:
-       cd lib
-       $(MAKE) -f Makefile.b32
-       cd ..\src
-       $(MAKE) -f Makefile.b32
-
-borland-ssl:
-       cd lib
-       $(MAKE) -f Makefile.b32 WITH_SSL=1
-       cd ..\src
-       $(MAKE) -f Makefile.b32 WITH_SSL=1
-
-borland-ssl-zlib:
-       cd lib
-       $(MAKE) -f Makefile.b32 WITH_SSL=1 WITH_ZLIB=1
-       cd ..\src
-       $(MAKE) -f Makefile.b32 WITH_SSL=1 WITH_ZLIB=1
-
-borland-clean:
-       cd lib
-       $(MAKE) -f Makefile.b32 clean
-       cd ..\src
-       $(MAKE) -f Makefile.b32 clean
-
 watcom: .SYMBOLIC
        cd lib && $(MAKE) -u -f Makefile.Watcom
        cd src && $(MAKE) -u -f Makefile.Watcom
diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index 482d4f1ca..21fd6e9e3 100644
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -1,130 +1,116 @@
-Curl and libcurl 7.60.0
+Curl and libcurl 7.61.0
 
- Public curl releases:         174
- Command line options:         214
- curl_easy_setopt() options:   255
+ Public curl releases:         175
+ Command line options:         218
+ curl_easy_setopt() options:   258
  Public functions in libcurl:  74
- Contributors:                 1741
+ Contributors:                 1766
 
 This release includes the following changes:
 
- o Add CURLOPT_HAPROXYPROTOCOL, support for the HAProxy PROXY protocol [10]
- o Add --haproxy-protocol for the command line tool [10]
- o Add CURLOPT_DNS_SHUFFLE_ADDRESSES, shuffle returned IP addresses [12]
+ o getinfo: add microsecond precise timers for seven intervals [3]
+ o curl: show headers in bold, switch off with --no-styled-output [10]
+ o httpauth: add support for Bearer tokens [16]
+ o Add CURLOPT_TLS13_CIPHERS and CURLOPT_PROXY_TLS13_CIPHERS [30]
+ o curl: --tls13-ciphers and --proxy-tls13-ciphers [30]
+ o Add CURLOPT_DISALLOW_USERNAME_IN_URL [32]
+ o curl: --disallow-username-in-url [32]
 
 This release includes the following bugfixes:
 
- o FTP: shutdown response buffer overflow CVE-2018-1000300 [88]
- o RTSP: bad headers buffer over-read CVE-2018-1000301 [89]
- o FTP: fix typo in recursive callback detection for seeking [1]
- o test1208: marked flaky
- o HTTP: make header-less responses still count correct body size [2]
- o user-agent.d:: mention --proxy-header as well [3]
- o http2: fixes typo [4]
- o cleanup: misc typos in strings and comments [5]
- o rate-limit: use three second window to better handle high speeds [6]
- o examples/hiperfifo.c: improved
- o pause: when changing pause state, update socket state [7]
- o multi: improved pending transfers handling => improved performance [8]
- o curl_version_info.3: fix ssl_version description [9]
- o add_handle/easy_perform: clear errorbuffer on start if set [11]
- o darwinssl: fix iOS build [13]
- o cmake: add support for brotli [14]
- o parsedate: support UT timezone [15]
- o vauth/ntlm.h: fix the #ifdef header guard
- o lib/curl_path.h: added #ifdef header guard
- o vauth/cleartext: fix integer overflow check [16]
- o CURLINFO_COOKIELIST.3: made the example not leak memory
- o cookie.d: mention that "-" as filename means stdin [17]
- o CURLINFO_SSL_VERIFYRESULT.3: fixed the example [18]
- o http2: read pending frames (including GOAWAY) in connection-check [19]
- o timeval: remove compilation warning by casting [20]
- o cmake: avoid warn-as-error during config checks [21]
- o travis-ci: enable -Werror for CMake builds [22]
- o openldap: fix for NULL return from ldap_get_attribute_ber() [23]
- o threaded resolver: track resolver time and set suitable timeout values [24]
- o cmake: Add advapi32 as explicit link library for win32 [25]
- o docs: fix CURLINFO_*_T examples use of CURL_FORMAT_CURL_OFF_T [26]
- o test1148: set a fixed locale for the test [27]
- o cookies: when reading from a file, only remove_expired once [28]
- o cookie: store cookies per top-level-domain-specific hash table [29]
- o openssl: fix build with LibreSSL 2.7 [30]
- o tls: fix mbedTLS 2.7.0 build + handle sha256 failures [31]
- o openssl: RESTORED verify locations when verifypeer==0 [32]
- o file: restore old behavior for file:////foo/bar URLs [33]
- o FTP: allow PASV on IPv6 connections when a proxy is being used [34]
- o build-openssl.bat: allow custom paths for VS and perl [35]
- o winbuild: make the clean target work without build-type [36]
- o build-openssl.bat: Refer to VS2017 as VC14.1 instead of VC15 [37]
- o curl: retry on FTP 4xx, ignore other protocols [38]
- o configure: detect (and use) sa_family_t [39]
- o examples/sftpuploadresume: Fix Windows large file seek
- o build: cleanup to fix clang warnings/errors [40]
- o winbuild: updated the documentation [41]
- o lib: silence null-dereference warnings [42]
- o travis: bump to clang 6 and gcc 7 [43]
- o travis: build libpsl and make builds use it [44]
- o proxy: show getenv proxy use in verbose output [45]
- o duphandle: make sure CURLOPT_RESOLVE is duplicated [46]
- o all: Refactor malloc+memset to use calloc [47]
- o checksrc: Fix typo [48]
- o system.h: Add sparcv8plus to oracle/sunpro 32-bit detection [49]
- o vauth: Fix typo [50]
- o ssh: show libSSH2 error code when closing fails [51]
- o test1148: tolerate progress updates better [52]
- o urldata: make service names unconditional [53]
- o configure: keep LD_LIBRARY_PATH changes local [54]
- o ntlm_sspi: fix authentication using Credential Manager [55]
- o schannel: add client certificate authentication [56]
- o winbuild: Support custom devel paths for each dependency [57]
- o schannel: add support for CURLOPT_CAINFO [58]
- o http2: handle on_begin_headers() called more than once [59]
- o openssl: support OpenSSL 1.1.1 verbose-mode trace messages [60]
- o openssl: fix subjectAltName check on non-ASCII platforms [61]
- o http2: avoid strstr() on data not zero terminated [62]
- o http2: clear the "drain counter" when a stream is closed [63]
- o http2: handle GOAWAY properly [64]
- o tool_help: clarify --max-time unit of time is seconds
- o curl.1: clarify that options and URLs can be mixed [65]
- o http2: convert an assert to run-time check [66]
- o curl_global_sslset: always provide available backends [67]
- o ftplistparser: keep state between invokes [68]
- o Curl_memchr: zero length input can't match
- o examples/sftpuploadresume: typecast fseek argument to long
- o examples/http2-upload: expand buffer to avoid silly warning
- o ctype: restore character classification for non-ASCII platforms [69]
- o mime: avoid NULL pointer dereference risk [70]
- o cookies: ensure that we have cookies before writing jar [71]
- o os400.c: fix checksrc warnings [72]
- o configure: provide --with-wolfssl as an alias for --with-cyassl
- o cyassl: adapt to libraries without TLS 1.0 support built-in
- o http2: get rid of another strstr [73]
- o checksrc: force indentation of lines after an else [74]
- o cookies: remove unused macro [75]
- o CURLINFO_PROTOCOL.3: mention the existing defined names
- o tests: provide 'manual' as a feature to optionally require [76]
- o travis: enable libssh2 on both macos and Linux [77]
- o CURLOPT_URL.3: added ENCODING section
- o wolfssl: Fix non-blocking connect [78]
- o vtls: don't define MD5_DIGEST_LENGTH for wolfssl
- o docs: remove extraneous commas in man pages [79]
- o URL: fix ASCII dependency in strcpy_url and strlen_url [80]
- o ssh-libssh.c: fix left shift compiler warning
- o configure: only check for CA bundle for file-using SSL backends [81]
- o travis: add an mbedtls build [82]
- o http: don't set the "rewind" flag when not uploading anything [83]
- o configure: put CURLDEBUG and DEBUGBUILD in lib/curl_config.h [84]
- o transfer: don't unset writesockfd on setup of multiplexed conns [85]
- o vtls: use unified "supports" bitfield member in backends [86]
- o URLs: fix one more http url [87]
- o travis: add a build using WolfSSL [90]
- o openssl: change FILE ops to BIO ops [91]
- o travis: add build using NSS [92]
- o smb: reject negative file sizes [93]
- o cookies: accept parameter names as cookie name [94]
- o http2: getsock fix for uploads [95]
- o all over: fixed format specifiers [96]
- o http2: use the correct function pointer typedef [97]
+ o CVE-2018-0500: smtp: fix SMTP send buffer overflow [82]
+ o schannel: disable client cert option if APIs not available [1]
+ o schannel: disable manual verify if APIs not available
+ o tests/libtest/Makefile: Do not unconditionally add gcc-specific flags [2]
+ o openssl: acknowledge --tls-max for default version too [4]
+ o stub_gssapi: fix 'unused parameter' warnings
+ o examples/progressfunc: make it build on both new and old libcurls [5]
+ o docs: mention it is HA Proxy protocol "version 1" [6]
+ o curl_fnmatch: only allow two asterisks for matching [7]
+ o docs: clarify CURLOPT_HTTPGET [8]
+ o configure: replace a AC_TRY_RUN with CURL_RUN_IFELSE [9]
+ o configure: do compile-time SIZEOF checks instead of run-time [9]
+ o checksrc: make sure sizeof() is used *with* parentheses [11]
+ o CURLOPT_ACCEPT_ENCODING.3: add brotli and clarify a bit
+ o schannel: make CAinfo parsing resilient to CR/LF [12]
+ o tftp: make sure error is zero terminated before printfing it
+ o http resume: skip body if http code 416 (range error) is ignored [13]
+ o configure: add basic test of --with-ssl prefix [14]
+ o cmake: set -d postfix for debug builds [15]
+ o multi: provide a socket to wait for in Curl_protocol_getsock [17]
+ o content_encoding: handle zlib versions too old for Z_BLOCK [18]
+ o winbuild: only delete OUTFILE if it exists [19]
+ o winbuild: In MakefileBuild.vc fix typo DISTDIR->DIRDIST [20]
+ o schannel: add failf calls for client certificate failures [21]
+ o cmake: Fix the test for fsetxattr and strerror_r
+ o curl.1: Fix cmdline-opts reference errors [22]
+ o cmdline-opts/gen.pl: warn if mutexes: or see-also: list non-existing options
+ o cmake: check for getpwuid_r [23]
+ o configure: fix ssh2 linking when built with a static mbedtls [24]
+ o psl: use latest psl and refresh it periodically [25]
+ o fnmatch: insist on escaped bracket to match [26]
+ o KNOWN_BUGS: restore text regarding #2101 [27]
+ o INSTALL: LDFLAGS=-Wl,-R/usr/local/ssl/lib [28]
+ o configure: override AR_FLAGS to silence warning [29]
+ o os400: implement mime api EBCDIC wrappers
+ o curl.rc: embed manifest for correct Windows version detection [31]
+ o strictness: correct {infof, failf} format specifiers [33]
+ o tests: update .gitignore for libtests [34]
+ o configure: check for declaration of getpwuid_r [35]
+ o fnmatch: use the system one if available [36]
+ o CURLOPT_RESOLVE: always purge old entry first [37]
+ o multi: remove a potentially bad DEBUGF() [38]
+ o curl_addrinfo: use same #ifdef conditions in source as header
+ o build: remove the Borland specific makefiles [39]
+ o axTLS: not considered fit for use [40]
+ o cmdline-opts/cert-type.d: mention "p12" as a recognized type
+ o system.h: add support for IBM xlc C compiler [41]
+ o tests/libtest: Add lib1521 to nodist_SOURCES [42]
+ o mk-ca-bundle.pl: leave certificate name untouched [43]
+ o boringssl + schannel: undef X509_NAME in lib/schannel.h [44]
+ o openssl: assume engine support in 1.0.1 or later [45]
+ o cppcheck: fix warnings [46]
+ o test 46: make test pass after year 2025 [47]
+ o schannel: support selecting ciphers [48]
+ o Curl_debug: remove dead printhost code [49]
+ o test 1455: unflakified [50]
+ o Curl_init_do: handle NULL connection pointer passed in [51]
+ o progress: remove a set of unused defines [52]
+ o mk-ca-bundle.pl: make -u delete certdata.txt if found not changed [53]
+ o GOVERNANCE.md: explains how this project is run [54]
+ o configure: use pkg-config for c-ares detection [55]
+ o configure: enhance ability to build with static openssl [56]
+ o maketgz: fix sed issues on OSX [57]
+ o multi: fix memory leak when stopped during name resolve [58]
+ o CURLOPT_INTERFACE.3: interface names not supported on Windows
+ o url: fix dangling conn->data pointer [59]
+ o cmake: allow multiple SSL backends [60]
+ o system.h: fix for gcc on 32 bit OpenServer [61]
+ o ConnectionExists: make sure conn->data is set when "taking" a connection 
[62]
+ o multi: fix crash due to dangling entry in connect-pending list [63]
+ o CURLOPT_SSL_VERIFYPEER.3: Add performance note [64]
+ o netrc: use a larger buffer to support longer passwords  [65]
+ o url: check Curl_conncache_add_conn return code [66]
+ o configure: Add dependent libraries after crypto [67]
+ o easy_perform: faster local name resolves by using *multi_timeout() [68]
+ o getnameinfo: not used, removed all configure checks [69]
+ o travis: add a build using the synchronous name resolver [70]
+ o CURLINFO_TLS_SSL_PTR.3: improve the example [71]
+ o openssl: allow TLS 1.3 by default [72]
+ o openssl: make the requested TLS version the *minimum* wanted [73]
+ o openssl: Remove some dead code [74]
+ o telnet: fix clang warnings [75]
+ o DEPRECATE: new doc describing planned item removals [76]
+ o example/crawler.c: simple crawler based on libxml2 [77]
+ o libssh: goto DISCONNECT state on error, not SESSION_FREE [78]
+ o CMake: Remove unused functions [79]
+ o darwinssl: allow High Sierra users to build the code using GCC [80]
+ o scripts: include _curl as part of CLEANFILES [81]
+ o examples: fix -Wformat warnings
+ o curl_setup: include <winerror.h> before <windows.h>
+ o schannel: make more cipher options conditional [83]
+ o CMake: remove redundant and old end-of-block syntax [84]
+ o post303.d: clarify that this is an RFC violation [85]
 
 This release includes the following known bugs:
 
@@ -133,120 +119,107 @@ This release includes the following known bugs:
 This release would not have looked like this without help, code, reports and
 advice from friends like these:
 
-  Adam Brown, Alex Baines, Anders Bakken, Anders Roxell, anshnd on github,
-  Bas van Schaik, Bernard Spil, Chris Araman, Christian Schmitz, Cyril B,
-  Dagobert Michelsen, Dan Fandrich, Daniel Gustafsson, Daniel Stenberg,
-  Dan McNulty, Dario Weisser, dasimx on github, David Garske, David L.,
-  Denis Ollier, Dmitry Mikhirev, Dongliang Mu, Don J Olmstead, Eric Gallager,
-  Ernst Sjöstrand, Frank Gevaerts, Gaurav Malhotra, Geeknik Labs, Howard Chu,
-  iz8mbw on github, Jakub Wilk, Jon DeVree, Kees Dekker, Kobi Gurkan,
-  Laurie Clark-Michalek, Lauri Kasanen, Lawrence Matthews, Luz Paz,
-  Marcel Raad, Max Dymond, Michael Kaufmann, Michael Kilburn,
-  Michał Janiszewski, Michal Trybus, Muz Dima, Nikos Tsipinakis, Ori Avtalion,
-  Oumph on github, patelvivekv1993 on github, Patrick Monnerat,
-  Philip Prindeville, Ray Satiro, Rick Deist, Rikard Falkeborn, Sergei Nikulov,
-  Stefan Agner, steini2000 on github, Stephan Mühlstrasser, Sunny Purushe,
-  Terry Wu, Vincas Razma, wncboy on github, Wyatt O'Day, 刘佩东,
-  (64 contributors)
+  Adrian Peniak, Alejandro R. Sedeño, Andreas Olsson, Archangel_SDY on github,
+  Bernhard M. Wiedemann, Bernhard Walle, Björn Stenberg, bsammon on github,
+  Dagobert Michelsen, Daniel Stenberg, Dario Nieuwenhuis, Dave Reisner,
+  elephoenix on github, Fabrice Fontaine, Frank Gevaerts, Gaurav Malhotra,
+  Gisle Vanem, Ithubg on github, Jakub Zakrzewski, Javier Blazquez,
+  Jeroen Ooms, Johannes Schindelin, Kevin R. Bulgrien, Linus Lewandowski,
+  Lyman Epp, Mamta Upadhyay, Marcel Raad, Marian Klymov, Matteo Bignotti,
+  Max Dymond, Max Savenkov, Nick Zitzmann, Oleg Pudeyev, Patrick Monnerat,
+  Patrick Schlangen, Per Malmberg, Peter Varga, Peter Wu, Philip Prindeville,
+  pszemus on github, Raphael Gozzo, Ray Satiro, Richard Alcock,
+  Rikard Falkeborn, Robert Prag, Ruslan Baratov, Sean Miller, Sergei Nikulov,
+  Stephan Mühlstrasser, Vasiliy Faronov, Viktor Szakats, Vladimir Kotal,
+  Will Dietz, Yaakov Selkowitz, zzq1015 on github,
+  (55 contributors)
 
         Thanks! (and sorry if I forgot to mention someone)
 
 References to bug reports and discussions on issues:
 
- [1] = https://curl.haxx.se/bug/?i=2380
- [2] = https://curl.haxx.se/bug/?i=2382
- [3] = https://curl.haxx.se/bug/?i=2381
- [4] = https://curl.haxx.se/bug/?i=2387
- [5] = https://curl.haxx.se/bug/?i=2389
- [6] = https://curl.haxx.se/bug/?i=2386
- [7] = https://curl.haxx.se/mail/lib-2018-03/0048.html
- [8] = https://curl.haxx.se/bug/?i=2369
- [9] = https://curl.haxx.se/bug/?i=2364
- [10] = https://curl.haxx.se/bug/?i=2162
- [11] = https://curl.haxx.se/bug/?i=2190
- [12] = https://curl.haxx.se/bug/?i=1694
- [13] = https://curl.haxx.se/bug/?i=2397
- [14] = https://curl.haxx.se/bug/?i=2392
- [15] = https://curl.haxx.se/bug/?i=2401
- [16] = https://curl.haxx.se/bug/?i=2408
- [17] = https://curl.haxx.se/bug/?i=2410
- [18] = https://curl.haxx.se/bug/?i=2400
- [19] = https://curl.haxx.se/bug/?i=1967
- [20] = https://curl.haxx.se/bug/?i=2358
- [21] = https://curl.haxx.se/bug/?i=2358
- [22] = https://curl.haxx.se/bug/?i=2418
- [23] = https://curl.haxx.se/bug/?i=2399
- [24] = https://curl.haxx.se/bug/?i=2419
- [25] = https://curl.haxx.se/bug/?i=2363
- [26] = https://curl.haxx.se/mail/lib-2018-03/0140.html
- [27] = https://curl.haxx.se/bug/?i=2436
- [28] = https://curl.haxx.se/bug/?i=2441
- [29] = https://curl.haxx.se/bug/?i=2440
- [30] = https://curl.haxx.se/bug/?i=2319
- [31] = https://curl.haxx.se/bug/?i=2453
- [32] = https://curl.haxx.se/bug/?i=2451
- [33] = https://curl.haxx.se/bug/?i=2438
- [34] = https://curl.haxx.se/bug/?i=2432
- [35] = https://curl.haxx.se/bug/?i=2430
- [36] = https://curl.haxx.se/bug/?i=2455
- [37] = https://curl.haxx.se/bug/?i=2189
- [38] = https://curl.haxx.se/bug/?i=2462
- [39] = https://curl.haxx.se/bug/?i=2463
- [40] = https://curl.haxx.se/bug/?i=2466
- [41] = https://curl.haxx.se/bug/?i=2472
- [42] = https://curl.haxx.se/bug/?i=2463
- [43] = https://curl.haxx.se/bug/?i=2478
- [44] = https://curl.haxx.se/bug/?i=2471
- [45] = https://curl.haxx.se/bug/?i=2480
- [46] = https://curl.haxx.se/bug/?i=2485
- [47] = https://curl.haxx.se/bug/?i=2497
- [48] = https://curl.haxx.se/bug/?i=2498
- [49] = https://curl.haxx.se/bug/?i=2491
- [50] = https://curl.haxx.se/bug/?i=2496
- [51] = https://curl.haxx.se/bug/?i=2500
- [52] = https://curl.haxx.se/bug/?i=2446
- [53] = https://curl.haxx.se/bug/?i=2479
- [54] = https://curl.haxx.se/bug/?i=2490
- [55] = https://curl.haxx.se/bug/?i=1622
- [56] = https://curl.haxx.se/bug/?i=2376
- [57] = https://curl.haxx.se/bug/?i=2474
- [58] = https://curl.haxx.se/bug/?i=1325
- [59] = https://curl.haxx.se/bug/?i=2507
- [60] = https://curl.haxx.se/bug/?i=2403
- [61] = https://curl.haxx.se/bug/?i=2493
- [62] = https://curl.haxx.se/bug/?i=2513
- [63] = https://curl.haxx.se/bug/?i=1680
- [64] = https://curl.haxx.se/bug/?i=2416
- [65] = https://curl.haxx.se/bug/?i=2515
- [66] = https://curl.haxx.se/bug/?i=2514
- [67] = https://curl.haxx.se/bug/?i=2499
- [68] = https://curl.haxx.se/bug/?i=2445
- [69] = https://curl.haxx.se/bug/?i=2494
- [70] = https://curl.haxx.se/bug/?i=2527
- [71] = https://curl.haxx.se/bug/?i=2529
- [72] = https://curl.haxx.se/bug/?i=2525
- [73] = https://curl.haxx.se/bug/?i=2534
- [74] = https://curl.haxx.se/bug/?i=2532
- [75] = https://curl.haxx.se/bug/?i=2537
- [76] = https://curl.haxx.se/bug/?i=2533
- [77] = https://curl.haxx.se/bug/?i=2541
- [78] = https://curl.haxx.se/bug/?i=2542
- [79] = https://curl.haxx.se/bug/?i=2544
- [80] = https://curl.haxx.se/bug/?i=2535
- [81] = https://curl.haxx.se/bug/?i=2180
- [82] = https://curl.haxx.se/bug/?i=2531
- [83] = https://curl.haxx.se/bug/?i=2546
- [84] = https://curl.haxx.se/bug/?i=2548
- [85] = https://curl.haxx.se/bug/?i=2520
- [86] = https://curl.haxx.se/bug/?i=2547
- [87] = https://curl.haxx.se/bug/?i=2550
- [88] = https://curl.haxx.se/docs/adv_2018-82c2.html
- [89] = https://curl.haxx.se/docs/adv_2018-b138.html
- [90] = https://curl.haxx.se/bug/?i=2528
- [91] = https://curl.haxx.se/bug/?i=2512
- [92] = https://curl.haxx.se/bug/?i=2558
- [93] = https://curl.haxx.se/bug/?i=2558
- [94] = https://curl.haxx.se/bug/?i=2564
- [95] = https://curl.haxx.se/bug/?i=2520
- [96] = https://curl.haxx.se/bug/?i=2561
- [97] = https://curl.haxx.se/bug/?i=2560
+ [1] = https://curl.haxx.se/bug/?i=2522
+ [2] = https://curl.haxx.se/bug/?i=2576
+ [3] = https://curl.haxx.se/bug/?i=2495
+ [4] = https://curl.haxx.se/bug/?i=2571
+ [5] = https://curl.haxx.se/bug/?i=2584
+ [6] = https://curl.haxx.se/bug/?i=2579
+ [7] = https://curl.haxx.se/bug/?i=2587
+ [8] = https://curl.haxx.se/bug/?i=2590
+ [9] = https://curl.haxx.se/bug/?i=2586
+ [10] = https://curl.haxx.se/bug/?i=2538
+ [11] = https://curl.haxx.se/bug/?i=2563
+ [12] = https://curl.haxx.se/bug/?i=2592
+ [13] = https://curl.haxx.se/bug/?i=1163
+ [14] = https://curl.haxx.se/bug/?i=2580
+ [15] = https://curl.haxx.se/bug/?i=2121
+ [16] = https://curl.haxx.se/bug/?i=2102
+ [17] = https://curl.haxx.se/mail/lib-2018-05/0062.html
+ [18] = https://curl.haxx.se/bug/?i=2606
+ [19] = https://curl.haxx.se/bug/?i=2602
+ [20] = https://curl.haxx.se/bug/?i=2603
+ [21] = https://curl.haxx.se/bug/?i=2604
+ [22] = https://curl.haxx.se/bug/?i=2612
+ [23] = https://curl.haxx.se/bug/?i=2609
+ [24] = https://curl.haxx.se/bug/?i=2613
+ [25] = https://curl.haxx.se/bug/?i=2553
+ [26] = https://curl.haxx.se/bug/?i=2614
+ [27] = https://curl.haxx.se/bug/?i=2618
+ [28] = https://curl.haxx.se/bug/?i=2615
+ [29] = https://curl.haxx.se/bug/?i=2617
+ [30] = https://curl.haxx.se/bug/?i=2435
+ [31] = https://curl.haxx.se/bug/?i=1221
+ [32] = https://curl.haxx.se/bug/?i=2340
+ [33] = https://curl.haxx.se/bug/?i=2623
+ [34] = https://curl.haxx.se/bug/?i=2624
+ [35] = https://curl.haxx.se/bug/?i=2609
+ [36] = https://curl.haxx.se/bug/?i=2626
+ [37] = https://curl.haxx.se/bug/?i=2622
+ [38] = https://curl.haxx.se/bug/?i=2627
+ [39] = https://curl.haxx.se/bug/?i=2629
+ [40] = https://curl.haxx.se/bug/?i=2628
+ [41] = https://curl.haxx.se/bug/?i=2637
+ [42] = https://curl.haxx.se/bug/?i=2633
+ [43] = https://curl.haxx.se/bug/?i=2640
+ [44] = https://curl.haxx.se/bug/?i=2634
+ [45] = https://curl.haxx.se/bug/?i=2641
+ [46] = https://curl.haxx.se/bug/?i=2631
+ [47] = https://curl.haxx.se/bug/?i=2646
+ [48] = https://curl.haxx.se/bug/?i=2630
+ [49] = https://curl.haxx.se/bug/?i=2647
+ [50] = https://curl.haxx.se/bug/?i=2649
+ [51] = https://curl.haxx.se/bug/?i=2653
+ [52] = https://curl.haxx.se/bug/?i=2654
+ [53] = https://curl.haxx.se/bug/?i=2655
+ [54] = https://curl.haxx.se/bug/?i=2657
+ [55] = https://curl.haxx.se/bug/?i=2203
+ [56] = https://curl.haxx.se/bug/?i=2199
+ [57] = https://curl.haxx.se/bug/?i=2660
+ [58] = https://curl.haxx.se/bug/?i=1968
+ [59] = https://curl.haxx.se/bug/?i=2669
+ [60] = https://curl.haxx.se/bug/?i=2665
+ [61] = https://curl.haxx.se/mail/lib-2018-06/0100.html
+ [62] = https://curl.haxx.se/bug/?i=2674
+ [63] = https://curl.haxx.se/bug/?i=2677
+ [64] = https://curl.haxx.se/bug/?i=2673
+ [65] = https://curl.haxx.se/bug/?i=2676
+ [66] = https://curl.haxx.se/bug/?i=2681
+ [67] = https://curl.haxx.se/bug/?i=2684
+ [68] = https://curl.haxx.se/bug/?i=2685
+ [69] = https://curl.haxx.se/bug/?i=2687
+ [70] = https://curl.haxx.se/bug/?i=2689
+ [71] = https://curl.haxx.se/bug/?i=2690
+ [72] = https://curl.haxx.se/bug/?i=2692
+ [73] = https://curl.haxx.se/bug/?i=2691
+ [74] = https://curl.haxx.se/bug/?i=2698
+ [75] = https://curl.haxx.se/bug/?i=2696
+ [76] = https://curl.haxx.se/dev/deprecate.html
+ [77] = https://curl.haxx.se/bug/?i=2706
+ [78] = https://curl.haxx.se/bug/?i=2708
+ [79] = https://curl.haxx.se/bug/?i=2711
+ [80] = https://curl.haxx.se/bug/?i=2656
+ [81] = https://curl.haxx.se/bug/?i=2718
+ [82] = https://curl.haxx.se/docs/adv_2018-70a2.html
+ [83] = https://curl.haxx.se/bug/?i=2721
+ [84] = https://curl.haxx.se/bug/?i=2715
+ [85] = https://curl.haxx.se/bug/?i=2723
diff --git a/acinclude.m4 b/acinclude.m4
index 69bb6c002..f32e86cda 100644
--- a/acinclude.m4
+++ b/acinclude.m4
@@ -5,7 +5,7 @@
 #                            | (__| |_| |  _ <| |___
 #                             \___|\___/|_| \_\_____|
 #
-# Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+# Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
 #
 # This software is licensed as described in the file COPYING, which
 # you should have received as part of this distribution. The terms
@@ -960,212 +960,6 @@ AC_DEFUN([CURL_CHECK_HEADER_MEMORY], [
   fi
 ])
 
-
-dnl CURL_CHECK_FUNC_GETNAMEINFO
-dnl -------------------------------------------------
-dnl Test if the getnameinfo function is available,
-dnl and check the types of five of its arguments.
-dnl If the function succeeds HAVE_GETNAMEINFO will be
-dnl defined, defining the types of the arguments in
-dnl GETNAMEINFO_TYPE_ARG1, GETNAMEINFO_TYPE_ARG2,
-dnl GETNAMEINFO_TYPE_ARG46 and GETNAMEINFO_TYPE_ARG7,
-dnl and also defining the type qualifier of first
-dnl argument in GETNAMEINFO_QUAL_ARG1.
-
-AC_DEFUN([CURL_CHECK_FUNC_GETNAMEINFO], [
-  AC_REQUIRE([CURL_CHECK_HEADER_WS2TCPIP])dnl
-  AC_CHECK_HEADERS(sys/types.h sys/socket.h netdb.h)
-  #
-  AC_MSG_CHECKING([for getnameinfo])
-  AC_LINK_IFELSE([
-    AC_LANG_FUNC_LINK_TRY([getnameinfo])
-  ],[
-    AC_MSG_RESULT([yes])
-    curl_cv_getnameinfo="yes"
-  ],[
-    AC_MSG_RESULT([no])
-    curl_cv_getnameinfo="no"
-  ])
-  #
-  if test "$curl_cv_getnameinfo" != "yes"; then
-    AC_MSG_CHECKING([deeper for getnameinfo])
-    AC_LINK_IFELSE([
-      AC_LANG_PROGRAM([[
-      ]],[[
-        getnameinfo();
-      ]])
-    ],[
-      AC_MSG_RESULT([yes])
-      curl_cv_getnameinfo="yes"
-    ],[
-      AC_MSG_RESULT([but still no])
-      curl_cv_getnameinfo="no"
-    ])
-  fi
-  #
-  if test "$curl_cv_getnameinfo" != "yes"; then
-    AC_MSG_CHECKING([deeper and deeper for getnameinfo])
-    AC_LINK_IFELSE([
-      AC_LANG_PROGRAM([[
-#undef inline
-#ifdef HAVE_WINDOWS_H
-#ifndef WIN32_LEAN_AND_MEAN
-#define WIN32_LEAN_AND_MEAN
-#endif
-#include <windows.h>
-#ifdef HAVE_WINSOCK2_H
-#include <winsock2.h>
-#ifdef HAVE_WS2TCPIP_H
-#include <ws2tcpip.h>
-#endif
-#endif
-#else
-#ifdef HAVE_SYS_TYPES_H
-#include <sys/types.h>
-#endif
-#ifdef HAVE_SYS_SOCKET_H
-#include <sys/socket.h>
-#endif
-#ifdef HAVE_NETDB_H
-#include <netdb.h>
-#endif
-#endif
-      ]],[[
-        getnameinfo(0, 0, 0, 0, 0, 0, 0);
-      ]])
-    ],[
-      AC_MSG_RESULT([yes])
-      curl_cv_getnameinfo="yes"
-    ],[
-      AC_MSG_RESULT([but still no])
-      curl_cv_getnameinfo="no"
-    ])
-  fi
-  #
-  if test "$curl_cv_getnameinfo" = "yes"; then
-    AC_CACHE_CHECK([types of arguments for getnameinfo],
-      [curl_cv_func_getnameinfo_args], [
-      curl_cv_func_getnameinfo_args="unknown"
-      for gni_arg1 in 'struct sockaddr *' 'const struct sockaddr *' 'void *'; 
do
-        for gni_arg2 in 'socklen_t' 'size_t' 'int'; do
-          for gni_arg46 in 'size_t' 'int' 'socklen_t' 'unsigned int' 'DWORD'; 
do
-            for gni_arg7 in 'int' 'unsigned int'; do
-              if test "$curl_cv_func_getnameinfo_args" = "unknown"; then
-                AC_COMPILE_IFELSE([
-                  AC_LANG_PROGRAM([[
-#undef inline
-#ifdef HAVE_WINDOWS_H
-#ifndef WIN32_LEAN_AND_MEAN
-#define WIN32_LEAN_AND_MEAN
-#endif
-#if (!defined(_WIN32_WINNT)) || (_WIN32_WINNT < 0x0501)
-#undef _WIN32_WINNT
-#define _WIN32_WINNT 0x0501
-#endif
-#include <windows.h>
-#ifdef HAVE_WINSOCK2_H
-#include <winsock2.h>
-#ifdef HAVE_WS2TCPIP_H
-#include <ws2tcpip.h>
-#endif
-#endif
-#define GNICALLCONV WSAAPI
-#else
-#ifdef HAVE_SYS_TYPES_H
-#include <sys/types.h>
-#endif
-#ifdef HAVE_SYS_SOCKET_H
-#include <sys/socket.h>
-#endif
-#ifdef HAVE_NETDB_H
-#include <netdb.h>
-#endif
-#define GNICALLCONV
-#endif
-                    extern int GNICALLCONV
-#ifdef __ANDROID__
-__attribute__((overloadable))
-#endif
-                               getnameinfo($gni_arg1, $gni_arg2,
-                                           char *, $gni_arg46,
-                                           char *, $gni_arg46,
-                                           $gni_arg7);
-                  ]],[[
-                    $gni_arg2 salen=0;
-                    $gni_arg46 hostlen=0;
-                    $gni_arg46 servlen=0;
-                    $gni_arg7 flags=0;
-                    int res = getnameinfo(0, salen, 0, hostlen, 0, servlen, 
flags);
-                  ]])
-                ],[
-                  
curl_cv_func_getnameinfo_args="$gni_arg1,$gni_arg2,$gni_arg46,$gni_arg7"
-                ])
-              fi
-            done
-          done
-        done
-      done
-    ]) # AC-CACHE-CHECK
-    if test "$curl_cv_func_getnameinfo_args" = "unknown"; then
-      AC_MSG_WARN([Cannot find proper types to use for getnameinfo args])
-      AC_MSG_WARN([HAVE_GETNAMEINFO will not be defined])
-    else
-      gni_prev_IFS=$IFS; IFS=','
-      set dummy `echo "$curl_cv_func_getnameinfo_args" | sed 's/\*/\*/g'`
-      IFS=$gni_prev_IFS
-      shift
-      #
-      gni_qual_type_arg1=$[1]
-      #
-      AC_DEFINE_UNQUOTED(GETNAMEINFO_TYPE_ARG2, $[2],
-        [Define to the type of arg 2 for getnameinfo.])
-      AC_DEFINE_UNQUOTED(GETNAMEINFO_TYPE_ARG46, $[3],
-        [Define to the type of args 4 and 6 for getnameinfo.])
-      AC_DEFINE_UNQUOTED(GETNAMEINFO_TYPE_ARG7, $[4],
-        [Define to the type of arg 7 for getnameinfo.])
-      #
-      prev_sh_opts=$-
-      #
-      case $prev_sh_opts in
-        *f*)
-          ;;
-        *)
-          set -f
-          ;;
-      esac
-      #
-      case "$gni_qual_type_arg1" in
-        const*)
-          gni_qual_arg1=const
-          gni_type_arg1=`echo $gni_qual_type_arg1 | sed 's/^const //'`
-        ;;
-        *)
-          gni_qual_arg1=
-          gni_type_arg1=$gni_qual_type_arg1
-        ;;
-      esac
-      #
-      AC_DEFINE_UNQUOTED(GETNAMEINFO_QUAL_ARG1, $gni_qual_arg1,
-        [Define to the type qualifier of arg 1 for getnameinfo.])
-      AC_DEFINE_UNQUOTED(GETNAMEINFO_TYPE_ARG1, $gni_type_arg1,
-        [Define to the type of arg 1 for getnameinfo.])
-      #
-      case $prev_sh_opts in
-        *f*)
-          ;;
-        *)
-          set +f
-          ;;
-      esac
-      #
-      AC_DEFINE_UNQUOTED(HAVE_GETNAMEINFO, 1,
-        [Define to 1 if you have the getnameinfo function.])
-      curl_cv_func_getnameinfo="yes"
-    fi
-  fi
-])
-
-
 dnl TYPE_SOCKADDR_STORAGE
 dnl -------------------------------------------------
 dnl Check for struct sockaddr_storage. Most IPv6-enabled
@@ -1203,107 +997,6 @@ AC_DEFUN([TYPE_SOCKADDR_STORAGE],
    ])
 ])
 
-
-dnl CURL_CHECK_NI_WITHSCOPEID
-dnl -------------------------------------------------
-dnl Check for working NI_WITHSCOPEID in getnameinfo()
-
-AC_DEFUN([CURL_CHECK_NI_WITHSCOPEID], [
-  AC_REQUIRE([CURL_CHECK_FUNC_GETNAMEINFO])dnl
-  AC_REQUIRE([TYPE_SOCKADDR_STORAGE])dnl
-  AC_CHECK_HEADERS(stdio.h sys/types.h sys/socket.h \
-                   netdb.h netinet/in.h arpa/inet.h)
-  #
-  AC_CACHE_CHECK([for working NI_WITHSCOPEID],
-    [curl_cv_working_ni_withscopeid], [
-    AC_RUN_IFELSE([
-      AC_LANG_PROGRAM([[
-#ifdef HAVE_STDLIB_H
-#include <stdlib.h>
-#endif
-#ifdef HAVE_STDIO_H
-#include <stdio.h>
-#endif
-#ifdef HAVE_SYS_TYPES_H
-#include <sys/types.h>
-#endif
-#ifdef HAVE_SYS_SOCKET_H
-#include <sys/socket.h>
-#endif
-#ifdef HAVE_NETDB_H
-#include <netdb.h>
-#endif
-#ifdef HAVE_NETINET_IN_H
-#include <netinet/in.h>
-#endif
-#ifdef HAVE_ARPA_INET_H
-#include <arpa/inet.h>
-#endif
-      ]],[[
-#if defined(NI_WITHSCOPEID) && defined(HAVE_GETNAMEINFO)
-#ifdef HAVE_STRUCT_SOCKADDR_STORAGE
-        struct sockaddr_storage sa;
-#else
-        unsigned char sa[256];
-#endif
-        char hostbuf[NI_MAXHOST];
-        int rc;
-        GETNAMEINFO_TYPE_ARG2 salen = (GETNAMEINFO_TYPE_ARG2)sizeof(sa);
-        GETNAMEINFO_TYPE_ARG46 hostlen = 
(GETNAMEINFO_TYPE_ARG46)sizeof(hostbuf);
-        GETNAMEINFO_TYPE_ARG7 flags = NI_NUMERICHOST | NI_NUMERICSERV | 
NI_WITHSCOPEID;
-        int fd = socket(AF_INET6, SOCK_STREAM, 0);
-        if(fd < 0) {
-          perror("socket()");
-          return 1; /* Error creating socket */
-        }
-        rc = getsockname(fd, (GETNAMEINFO_TYPE_ARG1)&sa, &salen);
-        if(rc) {
-          perror("getsockname()");
-          return 2; /* Error retrieving socket name */
-        }
-        rc = getnameinfo((GETNAMEINFO_TYPE_ARG1)&sa, salen, hostbuf, hostlen, 
NULL, 0, flags);
-        if(rc) {
-          printf("rc = %s\n", gai_strerror(rc));
-          return 3; /* Error translating socket address */
-        }
-        return 0; /* Ok, NI_WITHSCOPEID works */
-#else
-        return 4; /* Error, NI_WITHSCOPEID not defined or no getnameinfo() */
-#endif
-      ]]) # AC-LANG-PROGRAM
-    ],[
-      # Exit code == 0. Program worked.
-      curl_cv_working_ni_withscopeid="yes"
-    ],[
-      # Exit code != 0. Program failed.
-      curl_cv_working_ni_withscopeid="no"
-    ],[
-      # Program is not run when cross-compiling. So we assume
-      # NI_WITHSCOPEID will work if we are able to compile it.
-      AC_COMPILE_IFELSE([
-        AC_LANG_PROGRAM([[
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <netdb.h>
-        ]],[[
-          unsigned int dummy= NI_NUMERICHOST | NI_NUMERICSERV | NI_WITHSCOPEID;
-        ]])
-      ],[
-        curl_cv_working_ni_withscopeid="yes"
-      ],[
-        curl_cv_working_ni_withscopeid="no"
-      ]) # AC-COMPILE-IFELSE
-    ]) # AC-RUN-IFELSE
-  ]) # AC-CACHE-CHECK
-  case "$curl_cv_working_ni_withscopeid" in
-    yes)
-      AC_DEFINE(HAVE_NI_WITHSCOPEID, 1,
-        [Define to 1 if NI_WITHSCOPEID exists and works.])
-      ;;
-  esac
-])
-
-
 dnl CURL_CHECK_FUNC_RECV
 dnl -------------------------------------------------
 dnl Test if the socket recv() function is available,
@@ -2464,7 +2157,7 @@ AC_DEFUN([CURL_VERIFY_RUNTIMELIBS], [
     dnl just run a program to verify that the libs checked for previous to this
     dnl point also is available run-time!
     AC_MSG_CHECKING([run-time libs availability])
-    AC_TRY_RUN([
+    CURL_RUN_IFELSE([
 main()
 {
   return 0;
diff --git a/aux-gnurl/sed.sh b/aux-gnurl/sed.sh
index 24f822585..0aed3ce69 100755
--- a/aux-gnurl/sed.sh
+++ b/aux-gnurl/sed.sh
@@ -1,4 +1,5 @@
 #!/bin/sh
-sed -i 's/<curl\/curl.h>/<gnurl\/curl.h>/g' *
-sed -i 's/<curl\/curl.h>/<gnurl\/curl.h>/g' docs/libcurl/*
-sed -i 's/<curl\/curl.h>/<gnurl\/curl.h>/g' docs/libcurl/opts/*
+
+find . -not -iwholename '*.git*' -not -iwholename '*sed.sh*' -type f -print0 | 
xargs -0 sed -i 's/<curl\/curl.h>/<gnurl\/curl.h>/g'
+# find "docs/libcurl/*" -not -iwholename '*.git*' -not -iwholename '*sed.sh*' 
-type f -print0 | xargs -0 sed -i 's/<curl\/curl.h>/<gnurl\/curl.h>/g'
+# find "docs/libcurl/opts/" -not -iwholename '*.git*' -not -iwholename 
'*sed.sh*' -type f -print0 | xargs -0 sed -i 
's/<curl\/curl.h>/<gnurl\/curl.h>/g'
diff --git a/configure.ac b/configure.ac
index 0e3803ac0..b21dd584f 100755
--- a/configure.ac
+++ b/configure.ac
@@ -188,7 +188,8 @@ AC_CANONICAL_HOST
 dnl Get system canonical name
 AC_DEFINE_UNQUOTED(OS, "${host}", [cpu-machine-OS])
 
-dnl Checks for programs.
+# Silence warning: ar: 'u' modifier ignored since 'D' is the default
+AC_SUBST(AR_FLAGS, [cr])
 
 dnl This defines _ALL_SOURCE for AIX
 CURL_CHECK_AIX_ALL_SOURCE
@@ -2311,16 +2312,16 @@ AC_HEADER_TIME
 CURL_CHECK_STRUCT_TIMEVAL
 CURL_VERIFY_RUNTIMELIBS
 
-AC_CHECK_SIZEOF(size_t)
-AC_CHECK_SIZEOF(long)
-AC_CHECK_SIZEOF(int)
-AC_CHECK_SIZEOF(short)
-AC_CHECK_SIZEOF(time_t)
-AC_CHECK_SIZEOF(off_t)
+AX_COMPILE_CHECK_SIZEOF(size_t)
+AX_COMPILE_CHECK_SIZEOF(long)
+AX_COMPILE_CHECK_SIZEOF(int)
+AX_COMPILE_CHECK_SIZEOF(short)
+AX_COMPILE_CHECK_SIZEOF(time_t)
+AX_COMPILE_CHECK_SIZEOF(off_t)
 
 o=$CPPFLAGS
 CPPFLAGS="-I$srcdir/include $CPPFLAGS"
-AC_CHECK_SIZEOF(curl_off_t, unused , [
+AX_COMPILE_CHECK_SIZEOF(curl_off_t, [
 #include <gnurl/system.h>
 ])
 CPPFLAGS=$o
@@ -2477,7 +2478,13 @@ case $host in
     ;;
 esac
 
-AC_CHECK_FUNCS([geteuid \
+AC_CHECK_DECLS([getpwuid_r], [], [AC_DEFINE(HAVE_DECL_GETPWUID_R_MISSING, 1, 
"Set if getpwuid_r() declaration is missing")],
+        [[#include <pwd.h>
+          #include <sys/types.h>]])
+
+
+AC_CHECK_FUNCS([fnmatch \
+  geteuid \
   getpass_r \
   getppid \
   getpwuid \
@@ -2514,17 +2521,12 @@ AC_CHECK_FUNCS([geteuid \
   fi
 ])
 
-dnl Check if the getnameinfo function is available
-dnl and get the types of five of its arguments.
-CURL_CHECK_FUNC_GETNAMEINFO
-
 if test "$ipv6" = "yes"; then
   if test "$curl_cv_func_getaddrinfo" = "yes"; then
     AC_DEFINE(ENABLE_IPV6, 1, [Define if you want to enable IPv6 support])
     IPV6_ENABLED=1
     AC_SUBST(IPV6_ENABLED)
   fi
-  CURL_CHECK_NI_WITHSCOPEID
 fi
 
 CURL_CHECK_NONBLOCKING_SOCKET
diff --git a/docs/CIPHERS.md b/docs/CIPHERS.md
index e09533b0d..2a1d8ca7e 100644
--- a/docs/CIPHERS.md
+++ b/docs/CIPHERS.md
@@ -142,6 +142,16 @@ libcurl was built to use. This is an attempt to list known 
cipher names.
 `ECDHE-RSA-CAMELLIA128-SHA256`
 `ECDHE-RSA-CAMELLIA256-SHA384`
 
+### TLS 1.3 cipher suites
+
+(Note: the TLS 1.3 cipher suites are set with a separate option.)
+
+`TLS13-AES-256-GCM-SHA384`
+`TLS13-CHACHA20-POLY1305-SHA256`
+`TLS13-AES-128-GCM-SHA256`
+`TLS13-AES-128-CCM-8-SHA256`
+`TLS13-AES-128-CCM-SHA256`
+
 ## NSS
 
 ### Totally insecure
@@ -424,3 +434,54 @@ but libcurl maps them to the following case-insensitive 
names.
 `ECDHE-PSK-CHACHA20-POLY1305`,
 `DHE-PSK-CHACHA20-POLY1305`,
 `EDH-RSA-DES-CBC3-SHA`,
+
+## WinSSL
+
+WinSSL allows the enabling and disabling of encryption algorithms, but not 
specific ciphersuites. They are defined by Microsoft 
(https://msdn.microsoft.com/en-us/library/windows/desktop/aa375549(v=vs.85).aspx)
+
+`CALG_MD2`,
+`CALG_MD4`,
+`CALG_MD5`,
+`CALG_SHA`,
+`CALG_SHA1`,
+`CALG_MAC`,
+`CALG_RSA_SIGN`,
+`CALG_DSS_SIGN`,
+`CALG_NO_SIGN`,
+`CALG_RSA_KEYX`,
+`CALG_DES`,
+`CALG_3DES_112`,
+`CALG_3DES`,
+`CALG_DESX`,
+`CALG_RC2`,
+`CALG_RC4`,
+`CALG_SEAL`,
+`CALG_DH_SF`,
+`CALG_DH_EPHEM`,
+`CALG_AGREEDKEY_ANY`,
+`CALG_HUGHES_MD5`,
+`CALG_SKIPJACK`,
+`CALG_TEK`,
+`CALG_CYLINK_MEK`,
+`CALG_SSL3_SHAMD5`,
+`CALG_SSL3_MASTER`,
+`CALG_SCHANNEL_MASTER_HASH`,
+`CALG_SCHANNEL_MAC_KEY`,
+`CALG_SCHANNEL_ENC_KEY`,
+`CALG_PCT1_MASTER`,
+`CALG_SSL2_MASTER`,
+`CALG_TLS1_MASTER`,
+`CALG_RC5`,
+`CALG_HMAC`,
+`CALG_TLS1PRF`,
+`CALG_HASH_REPLACE_OWF`,
+`CALG_AES_128`,
+`CALG_AES_192`,
+`CALG_AES_256`,
+`CALG_AES`,
+`CALG_SHA_256`,
+`CALG_SHA_384`,
+`CALG_SHA_512`,
+`CALG_ECDH`,
+`CALG_ECMQV`,
+`CALG_ECDSA`,
diff --git a/docs/DEPRECATE.md b/docs/DEPRECATE.md
new file mode 100644
index 000000000..4506fae5c
--- /dev/null
+++ b/docs/DEPRECATE.md
@@ -0,0 +1,73 @@
+# Items to be removed from future curl releases
+
+If any of these deprecated features is a cause for concern for you, please
+email the curl-library mailing list as soon as possible and explain to us why
+this is a problem for you and how your use case can't be satisfied properly
+using a work around.
+
+## axTLS backend
+
+Here are some complaints on axTLS.
+
+ - home page without HTTPS
+ - [doesn't support modern TLS features like 
SNI](https://github.com/dsheets/axtls/issues/2)
+ - [lacks support for modern 
ciphers](https://github.com/micropython/micropython/issues/3198)
+ - [doesn't allow for outside bug report 
submissions](https://sourceforge.net/p/axtls/bugs/)
+ - there's virtually no discussion about it in its 
[forum](https://sourceforge.net/p/axtls/discussion/)
+   nor [mailing list](https://sourceforge.net/p/axtls/mailman/axtls-general/)
+
+Combined, this list hints that this is not a library and project we should
+recommend to users.
+
+### State
+
+Since June 1st, 2018 (curl 7.61.0) axTLS support is disabled in code and
+requires a small code change to build without errors. [See
+PR](https://github.com/curl/curl/pull/2628)
+
+### Removal
+
+Remove all axTLS related code from curl on December 1st, exactly six months
+after previously mentioned commit. To be shipped on December 26, 2018
+(possibly called version 7.64.0)
+
+## HTTP pipelining
+
+HTTP pipelining is badly supported by curl in the sense that we have bugs and
+it is a fragile feature without enough tests. Also, when something turns out
+to have problems it is really tricky to debug due to the timing sensitivity so
+very often enabling debug outputs or similar completely changes the nature of
+the behavior and things are not reproducing anymore!
+
+HTTP pipelining was never enabled by default by the large desktop browsers due
+to all the issues with it. Both Firefox and Chrome have also dropped
+pipelining support entirely since a long time back now. We are in fact over
+time becoming more and more lonely in supporting pipelining.
+
+The bad state of HTTP pipelining was a primary driving factor behind HTTP/2
+and its multiplexing feature. HTTP/2 multiplexing is truly and really
+"pipelining done right". It is way more solid, practical and solves the use
+case in a better way with better performance and fewer downsides and problems.
+
+In 2018, pipelining *should* be abandoned and HTTP/2 should be used instead.
+
+### State
+
+In 7.62.0 (release planned to happen in September 2018), we add code
+that ignores the "enable pipeline" option setting). The *setopt() function
+would still return "OK" though so the application couldn't tell that this is
+happening.
+
+Users who truly need pipelining from that version will need to modify the code
+(ever so slightly) and rebuild.
+
+### Removal
+
+Six months later, in sync with the planned release happen in April 2019,
+(might be 7.66.0), assuming no major riots have occurred due to this in the
+mean time, we rip out the pipelining code. It is in the order of 1000 lines of
+libcurl code.
+
+Left to answer: should the *setopt() function start to return error when these
+options are set to be able to tell when they're trying to use options that are
+no longer around or should we maintain behavior as much as possible?
diff --git a/docs/GOVERNANCE.md b/docs/GOVERNANCE.md
new file mode 100644
index 000000000..6de2eff41
--- /dev/null
+++ b/docs/GOVERNANCE.md
@@ -0,0 +1,144 @@
+# Decision making in the curl project
+
+A rough guide to how we make decisions and who does what.
+
+## BDFL
+
+This project was started by and has to some extent been pushed forward over
+the years with Daniel Stenberg as the driving force. It matches a standard
+BDFL (Benevolent Dictator For Life) style project.
+
+This setup has been used due to convenience and the fact that is has worked
+fine this far. It is not because someone thinks of it as a superior project
+leadership model. It will also only continue working as long as Daniel manages
+to listen in to what the project and the general user population wants and
+expects from us.
+
+## Legal entity
+
+There is no legal entity. The curl project is just a bunch of people scattered
+around the globe with the common goal to produce source code that creates
+great products.
+
+The copyrights in the project are owned by the individuals and organizations
+that wrote those parts of the code.
+
+## Decisions
+
+The curl project is not a democracy, but everyone is entitled to state their
+opinion and may argue for their sake within the community.
+
+All and any changes that have been done or will be done are eligible to bring
+up for discussion, to object to or to praise. Ideally, we find consensus for
+the appropriate way forward in any given situation or challenge.
+
+If there is no obvious consensus, a maintainer who's knowledgeable in the
+specific area will take an "executive" decision that they think is the right
+for the project.
+
+## Key roles
+
+### Maintainers
+
+A maintainer in the curl project is an individual who has been given
+permissions to push commits to one of the git repositories.
+
+Maintainers are free to push commits to the repositories at their own will.
+Maintainers are however expected to listen to feedback from users and any
+change that is non-trivial in size or nature *should* be brought to the
+project as a PR to allow others to comment/object before merge.
+
+### Former maintainers
+
+A maintainer who stops being active in the project will at some point get
+their push permissions removed. We do this for security reasons but also to
+make sure that we always have the list of maintainers as "the team that push
+stuff to curl".
+
+Getting push permissions removed is not a punishment. Everyone who ever worked
+on maintaining curl is considered a hero, for all time hereafter.
+
+### Security team members
+
+We have a security team. That's the team of people who are subscribed to the
+curl-security mailing list; the receivers of security reports from users and
+developers. This list of people will vary over time but should be skilled
+developers familiar with the curl project.
+
+The security team works best when it consists of a small set of active
+persons. We invite new members when the team seems to need it, and we also
+expect to retire security team members as they "drift off" from the project or
+just find themselves unable to perform their duties there.
+
+### Server admins
+
+We run a web server, a mailing list and more on the curl project's primary
+server. That physical machine is owned and run by Haxx. Daniel is the primary
+admin of all things curl related server stuff, but Björn Stenberg and Linus
+Feltzing serve as backup admins for when Daniel is gone or unable.
+
+The primary server is paid for by Haxx. The machine is physically located in a
+server bunker in Stockholm Sweden, operated by the company Portlane.
+
+The web site contents are served to the web via Fastly and Daniel is the
+primary curl contact with Fastly.
+
+### BDFL
+
+That's Daniel.
+
+# Maintainers
+
+A curl maintainer is a project volunteer who has the authority and rights to
+merge changes into a git repository in the curl project.
+
+Anyone can aspire to become a curl maintainer.
+
+### Duties
+
+There are no mandatory duties. We hope and wish that maintainers consider
+reviewing patches and help merching them, especially when the changes are
+within the area of personal expertise and experience.
+
+### Requirements
+
+- only merge code that meets our quality and style guide requirements.
+- *never* merge code without doing a PR first, unless the change is "trivial"
+- if in doubt, ask for input/feedback from others
+
+### Recommendations
+
+- please enable 2fa on your github account to reduce risk of malicious sourc
+  code tampering
+- consider enabling signed git commits for additional verification of changes
+
+### Merge advice
+
+When you're merging patches/PRs...
+
+- make sure the commit messages follow our template
+- squash patch sets into a few logical commits even if the PR didn't, if
+  necessary
+- avoid the "merge" button on github, do it "manually" instead to get full
+  control and full audit trail (github leaves out you as "Committer:")
+- remember to credit the reporter and the helpers!
+
+## Who are maintainers?
+
+The [list of maintainers](https://github.com/orgs/curl/people). Be aware that
+the level of presence and activity in the project vary greatly between
+different individuals and over time.
+
+### Become a maintainer?
+
+If you think you can help making the project better by shouldering some
+maintaining responsibilities, then please get in touch.
+
+You will be expected to be familiar with the curl project and its ways of
+working. You need to have gotten a few quality patches merged as a proof of
+this.
+
+### Stop being a maintainer
+
+If you (appear to) not be active in the project anymore, you may be removed as
+a maintainer. Thank you for your service!
diff --git a/docs/INSTALL.md b/docs/INSTALL.md
index 67a9378ff..767105c95 100644
--- a/docs/INSTALL.md
+++ b/docs/INSTALL.md
@@ -72,10 +72,9 @@ work:
 
 If you have shared SSL libs installed in a directory where your run-time
 linker doesn't find them (which usually causes configure failures), you can
-provide the -R option to ld on some operating systems to set a hard-coded
-path to the run-time linker:
+provide this option to gcc to set a hard-coded path to the run-time linker:
 
-    LDFLAGS=-R/usr/local/ssl/lib ./configure --with-ssl
+    LDFLAGS=-Wl,-R/usr/local/ssl/lib ./configure --with-ssl
 
 ## More Options
 
@@ -178,53 +177,6 @@ executable in /bin/ or you'll see the configure fail 
toward the end.
 
 Run `make`
 
-## Borland C++ compiler
-
-Ensure that your build environment is properly set up to use the compiler and
-associated tools. PATH environment variable must include the path to bin
-subdirectory of your compiler installation, eg: `c:\Borland\BCC55\bin`
-
-It is advisable to set environment variable BCCDIR to the base path of the
-compiler installation.
-
-    set BCCDIR=c:\Borland\BCC55
-
-In order to build a plain vanilla version of curl and libcurl run the
-following command from curl's root directory:
-
-    make borland
-
-To build curl and libcurl with zlib and OpenSSL support set environment
-variables `ZLIB_PATH` and `OPENSSL_PATH` to the base subdirectories of the
-already built zlib and OpenSSL libraries and from curl's root directory run
-command:
-
-    make borland-ssl-zlib
-
-libcurl library will be built in 'lib' subdirectory while curl tool is built
-in 'src' subdirectory. In order to use libcurl library it is advisable to
-modify compiler's configuration file bcc32.cfg located in
-`c:\Borland\BCC55\bin` to reflect the location of libraries include paths for
-example the '-I' line could result in something like:
-
-    -I"c:\Borland\BCC55\include;c:\curl\include;c:\openssl\inc32"
-
-bcc3.cfg `-L` line could also be modified to reflect the location of of
-libcurl library resulting for example:
-
-    -L"c:\Borland\BCC55\lib;c:\curl\lib;c:\openssl\out32"
-
-In order to build sample program `simple.c` from the docs\examples
-subdirectory run following command from mentioned subdirectory:
-
-    bcc32 simple.c libcurl.lib cw32mt.lib
-
-In order to build sample program simplessl.c an SSL enabled libcurl is
-required, as well as the OpenSSL libeay32.lib and ssleay32.lib libraries.
-
-In order to build sample program `sslbackend.c`, an SSL enabled libcurl
-is required.
-
 ## Disabling Specific Protocols in Windows builds
 
 The configure utility, unfortunately, is not available for the Windows
diff --git a/docs/KNOWN_BUGS b/docs/KNOWN_BUGS
index 7389da6dc..c8d8722ed 100644
--- a/docs/KNOWN_BUGS
+++ b/docs/KNOWN_BUGS
@@ -28,6 +28,7 @@ problems may have been fixed or changed somewhat since this 
was written!
  2.3 GnuTLS backend skips really long certificate fields
  2.4 DarwinSSL won't import PKCS#12 client certificates without a password
  2.5 Client cert handling with Issuer DN differs between backends
+ 2.6 CURL_GLOBAL_SSL
 
  3. Email protocols
  3.1 IMAP SEARCH ALL truncated response
@@ -36,15 +37,13 @@ problems may have been fixed or changed somewhat since this 
was written!
  3.4 POP3 expects "CRLF.CRLF" eob for some single-line responses
 
  4. Command line
- 4.1 -J with %-encoded file nameas
+ 4.1 -J and -O with %-encoded file names
  4.2 -J with -C - fails
  4.3 --retry and transfer timeouts
  4.4 --upload-file . hang if delay in STDIN
 
  5. Build and portability issues
- 5.1 Windows Borland compiler
  5.2 curl-config --libs contains private details
- 5.4 AIX shared build with c-ares fails
  5.5 can't handle Unicode arguments in Windows
  5.6 cmake support gaps
  5.7 Visual Studio project gaps
@@ -56,6 +55,7 @@ problems may have been fixed or changed somewhat since this 
was written!
  6.2 MIT Kerberos for Windows build
  6.3 NTLM in system context uses wrong name
  6.4 Negotiate and Kerberos V5 need a fake user name
+ 6.5 NTLM doen't support password with § character
 
  7. FTP
  7.1 FTP without or slow 220 response
@@ -67,6 +67,7 @@ problems may have been fixed or changed somewhat since this 
was written!
  7.7 FTP and empty path parts in the URL
  7.8 Premature transfer end but healthy control channel
  7.9 Passive transfer tries only one IP address
+ 7.10 Stick to same family over SOCKS proxy
 
  8. TELNET
  8.1 TELNET and time limtiations don't work
@@ -87,6 +88,7 @@ problems may have been fixed or changed somewhat since this 
was written!
  11.3 c-ares deviates from stock resolver on http://1346569778
  11.4 HTTP test server 'connection-monitor' problems
  11.5 Connection information when using TCP Fast Open
+ 11.6 slow connect to localhost on Windows
 
  12. LDAP and OpenLDAP
  12.1 OpenLDAP hangs after returning results
@@ -115,6 +117,9 @@ problems may have been fixed or changed somewhat since this 
was written!
  Disabling HTTP Pipelining when there are ongoing transfers can lead to
  heap corruption and crash. https://curl.haxx.se/bug/view.cgi?id=1411
 
+ Similarly, removing a handle when pipelining corrupts data:
+ https://github.com/curl/curl/issues/2101
+
 1.3 STARTTRANSFER time is wrong for HTTP POSTs
 
  Wrong STARTTRANSFER timer accounting for POST requests Timer works fine with
@@ -235,6 +240,35 @@ problems may have been fixed or changed somewhat since 
this was written!
 
  See https://github.com/curl/curl/issues/1411
 
+2.6 CURL_GLOBAL_SSL
+
+ Since libcurl 7.57.0, the flag CURL_GLOBAL_SSL is a no-op. The change was
+ merged in https://github.com/curl/curl/commit/d661b0afb571a
+
+ It was removed since it was
+
+ A) never clear for applications on how to deal with init in the light of
+    different SSL backends (the option was added back in the days when life
+    was simpler)
+
+ B) multissl introduced dynamic switching between SSL backends which
+    emphasized (A) even more
+
+ C) libcurl uses some TLS backend functionality even for non-TLS functions (to
+    get "good" random) so applications trying to avoid the init for
+    performance reasons would do wrong anyway
+
+ D) never very carefully documented so all this mostly just happened to work
+    for some users
+
+ However, in spite of the problems with the feature, there were some users who
+ apparently depended on this feature and who now claim libcurl is broken for
+ them. The fix for this situation is not obvious as a downright revert of the
+ patch is totally ruled out due to those reasons above.
+
+ https://github.com/curl/curl/issues/2276
+
+
 3. Email protocols
 
 3.1 IMAP SEARCH ALL truncated response
@@ -266,7 +300,7 @@ problems may have been fixed or changed somewhat since this 
was written!
 
 4. Command line
 
-4.1 -J with %-encoded file nameas
+4.1 -J and -O with %-encoded file names
 
  -J/--remote-header-name doesn't decode %-encoded file names. RFC6266 details
  how it should be done. The can of worm is basically that we have no charset
@@ -276,6 +310,13 @@ problems may have been fixed or changed somewhat since 
this was written!
  embedded slashes should be cut off.
  https://curl.haxx.se/bug/view.cgi?id=1294
 
+ -O also doesn't decode %-encoded names, and while it has even less
+ information about the charset involved the process is similar to the -J case.
+
+ Note that we won't add decoding to -O without the user asking for it with
+ some other means as well, since -O has always been documented to use the name
+ exactly as specified in the URL.
+
 4.2 -J with -C - fails
 
  When using -J (with -O), automatically resumed downloading together with "-C
@@ -303,23 +344,12 @@ problems may have been fixed or changed somewhat since 
this was written!
 
 5. Build and portability issues
 
-5.1 Windows Borland compiler
-
- When building with the Windows Borland compiler, it fails because the "tlib"
- tool doesn't support hyphens (minus signs) in file names and we have such in
- the build.  https://curl.haxx.se/bug/view.cgi?id=1222
-
 5.2 curl-config --libs contains private details
 
  "curl-config --libs" will include details set in LDFLAGS when configure is
  run that might be needed only for building libcurl. Further, curl-config
  --cflags suffers from the same effects with CFLAGS/CPPFLAGS.
 
-5.4 AIX shared build with c-ares fails
-
- curl version 7.12.2 fails on AIX if compiled with --enable-ares.  The
- workaround is to combine --enable-ares with --disable-shared
-
 5.5 can't handle Unicode arguments in Windows
 
  If a URL or filename can't be encoded using the user's current codepage then
@@ -413,6 +443,9 @@ problems may have been fixed or changed somewhat since this 
was written!
  new conn->bits.want_authentication which is set when any of the authentication
  options are set.
 
+6.5 NTLM doen't support password with § character
+
+ https://github.com/curl/curl/issues/2120
 
 7. FTP
 
@@ -503,6 +536,15 @@ problems may have been fixed or changed somewhat since 
this was written!
 
  See https://github.com/curl/curl/issues/1508
 
+7.10 Stick to same family over SOCKS proxy
+
+ When asked to do FTP over a SOCKS proxy, it might connect to the proxy (and
+ then subsequently to the remote server) using for example IPv4. When doing
+ the second connection, curl should make sure that the second connection is
+ using the same IP protocol version as the first connection did and not try
+ others, since the remote server will only accept the same.
+
+ See https://curl.haxx.se/mail/archive-2018-07/0000.html
 
 8. TELNET
 
@@ -598,6 +640,19 @@ problems may have been fixed or changed somewhat since 
this was written!
 
  See https://github.com/curl/curl/issues/1332
 
+11.6 slow connect to localhost on Windows
+
+ When connecting to "localhost" on Windows, curl will resolve the name for
+ both ipv4 and ipv6 and try to connect to both happy eyeballs-style. Something
+ in there does however make it take 200 millseconds to succeed - which is the
+ HAPPY_EYEBALLS_TIMEOUT define exactly. Lowering that define speeds up the
+ connection, suggesting a problem in the HE handling.
+
+ If we can *know* that we're talking to a local host, we should lower the
+ happy eyeballs delay timeout for IPv6 (related: hardcode the "localhost"
+ addresses, mentioned in TODO). Possibly we should reduce that delay for all.
+
+ https://github.com/curl/curl/issues/2281
 
 12. LDAP and OpenLDAP
 
diff --git a/docs/MAIL-ETIQUETTE b/docs/MAIL-ETIQUETTE
index effdcce21..07660a001 100644
--- a/docs/MAIL-ETIQUETTE
+++ b/docs/MAIL-ETIQUETTE
@@ -180,7 +180,7 @@ MAIL ETIQUETTE
   encoded HTTP Basic auth headers.
 
   This public nature of the curl mailing lists makes automatically inserted 
mail
-  footers about mails being "private" or "only meant for the receipient" or
+  footers about mails being "private" or "only meant for the recipient" or
   similar even more silly than usual. Because they are absolutely not private
   when sent to a public mailing list.
 
diff --git a/docs/Makefile.am b/docs/Makefile.am
index c6a5bb51a..16f34b0e2 100644
--- a/docs/Makefile.am
+++ b/docs/Makefile.am
@@ -40,13 +40,46 @@ DIST_SUBDIRS = $(SUBDIRS) examples libcurl
 
 CLEANFILES = $(GENHTMLPAGES) $(PDFPAGES) $(MANDISTPAGES) curl.1
 
-EXTRA_DIST = MANUAL BUGS CONTRIBUTE.md FAQ FEATURES INTERNALS.md SSLCERTS.md   
 \
- README.win32 RESOURCES TODO TheArtOfHttpScripting THANKS VERSIONS KNOWN_BUGS  
 \
- BINDINGS.md HISTORY.md INSTALL INSTALL.md LICENSE-MIXING.md     \
- README.netware MAIL-ETIQUETTE HTTP-COOKIES.md SECURITY-PROCESS.md 
RELEASE-PROCEDURE    \
- SSL-PROBLEMS.md HTTP2.md ROADMAP.md CODE_OF_CONDUCT.md CODE_STYLE.md          
 \
- CHECKSRC.md CMakeLists.txt README.md CIPHERS.md INSTALL.cmake README.cmake    
 \
- $(noinst_man_MANS) HELP-US.md
+EXTRA_DIST =                                    \
+ $(noinst_man_MANS)                             \
+ BINDINGS.md                                    \
+ BUGS                                           \
+ CHECKSRC.md                                    \
+ CIPHERS.md                                     \
+ CMakeLists.txt                                 \
+ CODE_OF_CONDUCT.md                             \
+ CODE_STYLE.md                                  \
+ CONTRIBUTE.md                                  \
+ DEPRECATE.md                                   \
+ FAQ                                            \
+ FEATURES                                       \
+ GOVERNANCE.md                                  \
+ HELP-US.md                                     \
+ HISTORY.md                                     \
+ HTTP-COOKIES.md                                \
+ HTTP2.md                                       \
+ INSTALL                                        \
+ INSTALL.cmake                                  \
+ INSTALL.md                                     \
+ INTERNALS.md                                   \
+ KNOWN_BUGS                                     \
+ LICENSE-MIXING.md                              \
+ MAIL-ETIQUETTE                                 \
+ MANUAL                                         \
+ README.cmake                                   \
+ README.md                                      \
+ README.netware                                 \
+ README.win32                                   \
+ RELEASE-PROCEDURE.md                           \
+ RESOURCES                                      \
+ ROADMAP.md                                     \
+ SECURITY-PROCESS.md                            \
+ SSL-PROBLEMS.md                                \
+ SSLCERTS.md                                    \
+ THANKS                                         \
+ TODO                                           \
+ TheArtOfHttpScripting                          \
+ VERSIONS
 
 MAN2HTML= roffit $< >$@
 
diff --git a/docs/RELEASE-PROCEDURE b/docs/RELEASE-PROCEDURE.md
similarity index 92%
rename from docs/RELEASE-PROCEDURE
rename to docs/RELEASE-PROCEDURE.md
index b7f8fcda0..637d0a70b 100644
--- a/docs/RELEASE-PROCEDURE
+++ b/docs/RELEASE-PROCEDURE.md
@@ -11,7 +11,8 @@ in the source code repo
 - make sure all relevant changes are committed on the master branch
 
 - tag the git repo in this style: `git tag -a curl-7_34_0`. -a annotates the
-  tag and we use underscores instead of dots in the version number.
+  tag and we use underscores instead of dots in the version number. Make sure
+  the tag is GPG signed (using -s).
 
 - run "./maketgz 7.34.0" to build the release tarballs. It is important that
   you run this on a machine with the correct set of autotools etc installed
@@ -35,7 +36,7 @@ in the curl-www repo
 
 - commit all local changes
 
-- tag the repo with the same tag as used for the source repo
+- tag the repo with the same name as used for the source repo.
 
 - make sure all relevant changes are committed and pushed on the master branch
 
@@ -83,13 +84,13 @@ Coming dates
 Based on the description above, here are some planned release dates (at the
 time of this writing):
 
-- November 29, 2017
-- January 24, 2018
-- March 21, 2018
-- May 16, 2018
 - July 11, 2018
 - September 5, 2018
 - October 31, 2018
 - December 26, 2018
 - February 20, 2019
 - April 17, 2019
+- June 12, 2019
+- August 7, 2019
+- October 2, 2019
+- December 27, 2019
diff --git a/docs/THANKS b/docs/THANKS
index 540a59fc4..661fae084 100644
--- a/docs/THANKS
+++ b/docs/THANKS
@@ -18,6 +18,7 @@ Adam Marcionek
 Adam Piggott
 Adam Sampson
 Adam Tkac
+Adrian Peniak
 Adrian Schuur
 Adriano Meirelles
 Ajit Dhumale
@@ -32,6 +33,7 @@ Albert Chin-A-Young
 Albert Choy
 Ale Vesely
 Alejandro Alvarez Ayllon
+Alejandro R. Sedeño
 Aleksandar Milivojevic
 Aleksey Tulinov
 Ales Mlakar
@@ -136,6 +138,7 @@ Anton Yabchinskiy
 Antonio Larrosa
 Antony74 on github
 Antti Hätälä
+Archangel_SDY on github
 Arkadiusz Miskiewicz
 Armel Asselin
 Arnaud Compan
@@ -179,6 +182,7 @@ Bernard Leak
 Bernard Spil
 Bernhard M. Wiedemann
 Bernhard Reutner-Fischer
+Bernhard Walle
 Bert Huijben
 Bertrand Demiddelaer
 Bertrand Simonnet
@@ -345,6 +349,7 @@ Daniel Stenberg
 Daniel Theron
 Daniel at touchtunes
 Daphne Luong
+Dario Nieuwenhuis
 Dario Weisser
 Darryl House
 Darshan Mody
@@ -512,6 +517,7 @@ Fabian Frank
 Fabian Hiernaux
 Fabian Keil
 Fabian Ruff
+Fabrice Fontaine
 Fabrizio Ammollo
 Fahim Chandurwala
 Fedor Karpelevitch
@@ -661,6 +667,7 @@ Ingo Wilken
 Irfan Adilovic
 Isaac Boukris
 Ishan SinghLevett
+Ithubg on github
 Ivan Avdeev
 Ivo Bellin Salarin
 Jack Zhang
@@ -704,6 +711,7 @@ Jason Liu
 Jason McDonald
 Jason S. Priebe
 Javier Barroso
+Javier Blazquez
 Javier G. Sogo
 Javier Sixto
 Jay Austin
@@ -875,6 +883,7 @@ Kevin Baughman
 Kevin Fisk
 Kevin Ji
 Kevin Lussier
+Kevin R. Bulgrien
 Kevin Reed
 Kevin Roth
 Kevin Smith
@@ -931,6 +940,7 @@ Lijo Antony
 Linas Vepstas
 Lindley French
 Ling Thio
+Linus Lewandowski
 Linus Nielsen Feltzing
 Linus Nordberg
 Lior Kaplan
@@ -958,6 +968,7 @@ Luo Jinghua
 Luong Dinh Dung
 Luz Paz
 Luật Nguyễn
+Lyman Epp
 Lyndon Hill
 Maciej Karpiuk
 Maciej Puzio
@@ -967,6 +978,7 @@ Maks Naumov
 Maksim Kuzevanov
 Maksim Stsepanenka
 Mamoru Tasaka
+Mamta Upadhyay
 Mandy Wu
 Manfred Schwarb
 Manuel Massing
@@ -992,6 +1004,7 @@ Marco Maggi
 Marcus Hoffmann
 Marcus Sundberg
 Marcus Webster
+Marian Klymov
 Mario Schroeder
 Mark Brand
 Mark Butler
@@ -1040,6 +1053,7 @@ Matt Veenstra
 Matt Witherspoon
 Matt Wixson
 Matteo B.
+Matteo Bignotti
 Matteo Rocco
 Matthew Blain
 Matthew Clarke
@@ -1053,6 +1067,7 @@ Mauro Rappa
 Max Dymond
 Max Katsev
 Max Khon
+Max Savenkov
 Maxim Ivanov
 Maxim Perenesenko
 Maxim Prohorov
@@ -1251,6 +1266,7 @@ Peter Silva
 Peter Su
 Peter Sylvester
 Peter Todd
+Peter Varga
 Peter Verhas
 Peter Wang
 Peter Wu
@@ -1307,6 +1323,7 @@ Ramana Mokkapati
 Randall S. Becker
 Randy Armstrong
 Randy McMurchy
+Raphael Gozzo
 Ravi Pratap
 Ray Dassen
 Ray Pekowski
@@ -1365,6 +1382,7 @@ Robert Foreman
 Robert Iakobashvili
 Robert Kolcun
 Robert Olson
+Robert Prag
 Robert Schumann
 Robert Weaver
 Robert Wruck
@@ -1392,6 +1410,7 @@ Ronnie Mose
 Rosimildo da Silva
 Roy Shan
 Rune Kleveland
+Ruslan Baratov
 Ruslan Gazizov
 Rutger Hofman
 Ruurd Beerstra
@@ -1433,6 +1452,7 @@ Scott McCreary
 Sean Boudreau
 Sean Burford
 Sean MacLennan
+Sean Miller
 Sebastian Mundry
 Sebastian Pohlschmidt
 Sebastian Rasmussen
@@ -1618,6 +1638,7 @@ Ulrich Doehner
 Ulrich Telle
 Ulrich Zadow
 Valentin David
+Vasiliy Faronov
 Vasy Okhin
 Venkat Akella
 Venkataramana Mokkapati
@@ -1636,6 +1657,7 @@ Vincent Torri
 Vlad Grachov
 Vlad Ureche
 Vladimir Grishchenko
+Vladimir Kotal
 Vladimir Lazarenko
 Vojtech Janota
 Vojtech Minarik
@@ -1702,6 +1724,7 @@ dkjjr89 on github
 dpull on github
 eXeC64 on github
 elelel on github
+elephoenix on github
 guitared on github
 hsiao yi
 imilli on github
@@ -1728,6 +1751,7 @@ omau on github
 ovidiu-benea on github
 patelvivekv1993 on github
 paulharris on github
+pszemus on github
 silveja1 on github
 steelman on github
 steini2000 on github
@@ -1741,6 +1765,7 @@ wncboy on github
 wyattoday on github
 youngchopin on github
 zelinchen on github
+zzq1015 on github
 İsmail Dönmez
 Łukasz Domeradzki
 Štefan Kremeň
diff --git a/docs/TODO b/docs/TODO
index cd0d6f2b6..269c93006 100644
--- a/docs/TODO
+++ b/docs/TODO
@@ -17,7 +17,6 @@
  All bugs documented in the KNOWN_BUGS document are subject for fixing!
 
  1. libcurl
- 1.1 Option to refuse usernames in URLs
  1.2 More data sharing
  1.3 struct lifreq
  1.4 signal-based resolver timeouts
@@ -38,6 +37,7 @@
  1.19 Timeout idle connections from the pool
  1.20 SRV and URI DNS records
  1.21 API for URL parsing/splitting
+ 1.22 CURLINFO_PAUSE_STATE
  1.23 Offer API to flush the connection pool
  1.24 TCP Fast Open for windows
  1.25 Expose tried IP addresses that failed
@@ -112,6 +112,7 @@
  13.6 Provide callback for cert verification
  13.7 improve configure --with-ssl
  13.8 Support DANE
+ 13.9 Configurable loading of OpenSSL configuration file
  13.11 Support intermediate & root pinning for PINNEDPUBLICKEY
  13.12 Support HSTS
  13.13 Support HPKP
@@ -188,16 +189,6 @@
 
 1. libcurl
 
-1.1 Option to refuse usernames in URLs
-
- There's a certain risk for application in allowing user names in URLs. For
- example: if the wrong person gets to set the URL and manages to set a user
- name in there when .netrc is used, the application may send along a password
- that otherwise the person couldn't provide.
-
- A new libcurl option could be added to allow applications to switch off this
- feature and thus avoid a potential risk.
-
 1.2 More data sharing
 
  curl_share_* functions already exist and work, and they can be extended to
@@ -387,6 +378,11 @@
  using libcurl need that ability. In polls to users, we've learned that many
  libcurl users would like to see and use such an API.
 
+1.22 CURLINFO_PAUSE_STATE
+
+ Return information about the transfer's current pause state, in both
+ directions. https://github.com/curl/curl/issues/2588
+
 1.23 Offer API to flush the connection pool
 
  Sometimes applications want to flush all the existing connections kept alive.
@@ -772,6 +768,17 @@ that doesn't exist on the server, just like 
--ftp-create-dirs.
  Björn Stenberg wrote a separate initial take on DANE that was never
  completed.
 
+13.9 Configurable loading of OpenSSL configuration file
+
+ libcurl calls the OpenSSL function CONF_modules_load_file() in openssl.c,
+ Curl_ossl_init(). "We regard any changes in the OpenSSL configuration as a
+ security risk or at least as unnecessary."
+
+ Please add a configuration switch or something similar to disable the
+ CONF_modules_load_file() call.
+
+ See https://github.com/curl/curl/issues/2724
+
 13.11 Support intermediate & root pinning for PINNEDPUBLICKEY
 
  CURLOPT_PINNEDPUBLICKEY does not consider the hashes of intermediate & root
diff --git a/docs/cmdline-opts/Makefile.inc b/docs/cmdline-opts/Makefile.inc
index 778149ca3..67fe1a04b 100644
--- a/docs/cmdline-opts/Makefile.inc
+++ b/docs/cmdline-opts/Makefile.inc
@@ -46,6 +46,7 @@ DPAGES = abstract-unix-socket.d anyauth.d append.d basic.d 
cacert.d capath.d cer
   tlsauthtype.d tlspassword.d tlsuser.d tlsv1.0.d tlsv1.1.d tlsv1.2.d   \
   tlsv1.3.d tlsv1.d trace-ascii.d trace.d trace-time.d tr-encoding.d    \
   unix-socket.d upload-file.d url.d use-ascii.d user-agent.d user.d     \
-  verbose.d version.d write-out.d xattr.d request-target.d
+  verbose.d version.d write-out.d xattr.d request-target.d              \
+  styled-output.d tls13-ciphers.d proxy-tls13-ciphers.d
 
 OTHERPAGES = page-footer page-header
diff --git a/docs/cmdline-opts/cert-type.d b/docs/cmdline-opts/cert-type.d
index a04bdce5d..55d8033b4 100644
--- a/docs/cmdline-opts/cert-type.d
+++ b/docs/cmdline-opts/cert-type.d
@@ -1,10 +1,10 @@
 Long: cert-type
 Protocols: TLS
 Arg: <type>
-Help: Certificate file type (DER/PEM/ENG)
+Help: Certificate file type
 See-also: cert key key-type
 ---
-Tells curl what certificate type the provided certificate is in. PEM, DER and
-ENG are recognized types.  If not specified, PEM is assumed.
+Tells curl what type the provided client certificate is using. PEM, DER, ENG
+and P12 are recognized types.  If not specified, PEM is assumed.
 
 If this option is used several times, the last one will be used.
diff --git a/docs/cmdline-opts/ciphers.d b/docs/cmdline-opts/ciphers.d
index d3bac6026..69e85525a 100644
--- a/docs/cmdline-opts/ciphers.d
+++ b/docs/cmdline-opts/ciphers.d
@@ -1,6 +1,6 @@
 Long: ciphers
 Arg: <list of ciphers>
-help: SSL ciphers to use
+Help: SSL ciphers to use
 Protocols: TLS
 ---
 Specifies which ciphers to use in the connection. The list of ciphers must
diff --git a/docs/cmdline-opts/data.d b/docs/cmdline-opts/data.d
index 157285840..7d499665e 100644
--- a/docs/cmdline-opts/data.d
+++ b/docs/cmdline-opts/data.d
@@ -4,7 +4,7 @@ Arg: <data>
 Help: HTTP POST data
 Protocols: HTTP
 See-also: data-binary data-urlencode data-raw
-Mutexed: form head upload
+Mutexed: form head upload-file
 ---
 Sends the specified data in a POST request to the HTTP server, in the same way
 that a browser does when a user has filled in an HTML form and presses the
diff --git a/docs/cmdline-opts/disallow-username-in-url.d 
b/docs/cmdline-opts/disallow-username-in-url.d
new file mode 100644
index 000000000..a7f46ea15
--- /dev/null
+++ b/docs/cmdline-opts/disallow-username-in-url.d
@@ -0,0 +1,7 @@
+Long: disallow-username-in-url
+Help: Disallow username in url
+Protocols: HTTP
+Added: 7.61.0
+See-also: proto
+---
+This tells curl to exit if passed a url containing a username.
diff --git a/docs/cmdline-opts/form.d b/docs/cmdline-opts/form.d
index 8d04d4193..0bbc3701f 100644
--- a/docs/cmdline-opts/form.d
+++ b/docs/cmdline-opts/form.d
@@ -3,7 +3,7 @@ Short: F
 Arg: <name=content>
 Help: Specify multipart MIME data
 Protocols: HTTP SMTP IMAP
-Mutexed: data head upload
+Mutexed: data head upload-file
 ---
 For HTTP protocol family, this lets curl emulate a filled-in form in which a
 user has pressed the submit button. This causes curl to POST data using the
diff --git a/docs/cmdline-opts/gen.pl b/docs/cmdline-opts/gen.pl
index 4e15aebeb..aae4dd85e 100755
--- a/docs/cmdline-opts/gen.pl
+++ b/docs/cmdline-opts/gen.pl
@@ -202,6 +202,9 @@ sub single {
         my @m=split(/ /, $seealso);
         my $mstr;
         for my $k (@m) {
+            if(!$helplong{$k}) {
+                print STDERR "WARN: $f see-alsos a non-existing option: $k\n";
+            }
             my $l = manpageify($k);
             $mstr .= sprintf "%s$l", $mstr?" and ":"";
         }
@@ -216,6 +219,9 @@ sub single {
         my @m=split(/ /, $mutexed);
         my $mstr;
         for my $k (@m) {
+            if(!$helplong{$k}) {
+                print STDERR "WARN: $f mutexes a non-existing option: $k\n";
+            }
             my $l = manpageify($k);
             $mstr .= sprintf "%s$l", $mstr?" and ":"";
         }
diff --git a/docs/cmdline-opts/haproxy-protocol.d 
b/docs/cmdline-opts/haproxy-protocol.d
index 52e156058..cc41c9c44 100644
--- a/docs/cmdline-opts/haproxy-protocol.d
+++ b/docs/cmdline-opts/haproxy-protocol.d
@@ -1,9 +1,9 @@
 Long: haproxy-protocol
-Help: Send HAProxy PROXY protocol header
+Help: Send HAProxy PROXY protocol v1 header
 Protocols: HTTP
 Added: 7.60.0
 ---
-Send a HAProxy PROXY protocol header at the beginning of the connection. This
+Send a HAProxy PROXY protocol v1 header at the beginning of the connection. 
This
 is used by some load balancers and reverse proxies to indicate the client's
 true IP address and port.
 
diff --git a/docs/cmdline-opts/ntlm.d b/docs/cmdline-opts/ntlm.d
index d71cd43fe..baaa1d534 100644
--- a/docs/cmdline-opts/ntlm.d
+++ b/docs/cmdline-opts/ntlm.d
@@ -1,6 +1,6 @@
 Long: ntlm
 Help: Use HTTP NTLM authentication
-Mutexed: basic negotiated digest anyauth
+Mutexed: basic negotiate digest anyauth
 See-also: proxy-ntlm
 Protocols: HTTP
 Requires: TLS
diff --git a/docs/cmdline-opts/post303.d b/docs/cmdline-opts/post303.d
index f8a60ec5f..44f39e610 100644
--- a/docs/cmdline-opts/post303.d
+++ b/docs/cmdline-opts/post303.d
@@ -4,8 +4,7 @@ Protocols: HTTP
 See-also: post302 post301 location
 Added: 7.26.0
 ---
-Tells curl to respect RFC 7231/6.4.4 and not convert POST requests into GET
-requests when following a 303 redirection. The non-RFC behaviour is ubiquitous
-in web browsers, so curl does the conversion by default to maintain
-consistency. However, a server may require a POST to remain a POST after such
-a redirection. This option is meaningful only when using --location.
+Tells curl to violate RFC 7231/6.4.4 and not convert POST requests into GET
+requests when following 303 redirections. A server may require a POST to
+remain a POST after a 303 redirection. This option is meaningful only when
+using --location.
diff --git a/docs/cmdline-opts/proxy-service-name.d 
b/docs/cmdline-opts/proxy-service-name.d
index e774d2427..9a73f2be6 100644
--- a/docs/cmdline-opts/proxy-service-name.d
+++ b/docs/cmdline-opts/proxy-service-name.d
@@ -1,4 +1,4 @@
-long: proxy-service-name
+Long: proxy-service-name
 Arg: <name>
 Help: SPNEGO proxy service name
 Added: 7.43.0
diff --git a/docs/cmdline-opts/proxy-tls13-ciphers.d 
b/docs/cmdline-opts/proxy-tls13-ciphers.d
new file mode 100644
index 000000000..3e35b0764
--- /dev/null
+++ b/docs/cmdline-opts/proxy-tls13-ciphers.d
@@ -0,0 +1,12 @@
+Long: proxy-tls13-ciphers
+Arg: <ciphersuite list>
+help: TLS 1.3 proxy cipher suites
+Protocols: TLS
+---
+Specifies which cipher suites to use in the connection to your HTTPS proxy
+when it negotiates TLS 1.3. The list of ciphers suites must specify valid
+ciphers. Read up on TLS 1.3 cipher suite details on this URL:
+
+ https://curl.haxx.se/docs/ssl-ciphers.html
+
+If this option is used several times, the last one will be used.
diff --git a/docs/cmdline-opts/remote-time.d b/docs/cmdline-opts/remote-time.d
index 0f369e01f..7f6809dc3 100644
--- a/docs/cmdline-opts/remote-time.d
+++ b/docs/cmdline-opts/remote-time.d
@@ -1,5 +1,5 @@
-long: remote-time
-short: R
+Long: remote-time
+Short: R
 Help: Set the remote file's time on the local output
 ---
 When used, this will make curl attempt to figure out the timestamp of the
diff --git a/docs/cmdline-opts/retry-delay.d b/docs/cmdline-opts/retry-delay.d
index 43c5affa2..1691356d4 100644
--- a/docs/cmdline-opts/retry-delay.d
+++ b/docs/cmdline-opts/retry-delay.d
@@ -1,5 +1,5 @@
-long: retry-delay
-arg: <seconds>
+Long: retry-delay
+Arg: <seconds>
 Help: Wait time between retries
 Added: 7.12.3
 ---
diff --git a/docs/cmdline-opts/retry-max-time.d 
b/docs/cmdline-opts/retry-max-time.d
index 1c2f972ab..0920c9244 100644
--- a/docs/cmdline-opts/retry-max-time.d
+++ b/docs/cmdline-opts/retry-max-time.d
@@ -1,4 +1,4 @@
-long: retry-max-time
+Long: retry-max-time
 Arg: <seconds>
 Help: Retry only within this period
 Added: 7.12.3
diff --git a/docs/cmdline-opts/sasl-ir.d b/docs/cmdline-opts/sasl-ir.d
index 120b19da0..c0dab9463 100644
--- a/docs/cmdline-opts/sasl-ir.d
+++ b/docs/cmdline-opts/sasl-ir.d
@@ -1,4 +1,4 @@
-long: sasl-ir
+Long: sasl-ir
 Help: Enable initial response in SASL authentication
 Added: 7.31.0
 ---
diff --git a/docs/cmdline-opts/show-error.d b/docs/cmdline-opts/show-error.d
index ede174b7d..b9667a4ca 100644
--- a/docs/cmdline-opts/show-error.d
+++ b/docs/cmdline-opts/show-error.d
@@ -1,4 +1,4 @@
-long: show-error
+Long: show-error
 Short: S
 Help: Show error even when -s is used
 ---
diff --git a/docs/cmdline-opts/silent.d b/docs/cmdline-opts/silent.d
index 7603b7634..b0b4425b3 100644
--- a/docs/cmdline-opts/silent.d
+++ b/docs/cmdline-opts/silent.d
@@ -1,4 +1,4 @@
-long: silent
+Long: silent
 Short: s
 Help: Silent mode
 See-also: verbose stderr
diff --git a/docs/cmdline-opts/ssl-reqd.d b/docs/cmdline-opts/ssl-reqd.d
index b21aed104..3c6f8a257 100644
--- a/docs/cmdline-opts/ssl-reqd.d
+++ b/docs/cmdline-opts/ssl-reqd.d
@@ -1,4 +1,4 @@
-long: ssl-reqd
+Long: ssl-reqd
 Help: Require SSL/TLS
 Protocols: FTP IMAP POP3 SMTP
 Added: 7.20.0
diff --git a/docs/cmdline-opts/ssl.d b/docs/cmdline-opts/ssl.d
index 71c187ae3..dabd83761 100644
--- a/docs/cmdline-opts/ssl.d
+++ b/docs/cmdline-opts/ssl.d
@@ -1,4 +1,4 @@
-long: ssl
+Long: ssl
 Help: Try SSL/TLS
 Protocols: FTP IMAP POP3 SMTP
 Added: 7.20.0
diff --git a/docs/cmdline-opts/styled-output.d 
b/docs/cmdline-opts/styled-output.d
new file mode 100644
index 000000000..e4751aecb
--- /dev/null
+++ b/docs/cmdline-opts/styled-output.d
@@ -0,0 +1,6 @@
+Long: styled-output
+Help: Enable styled output for HTTP headers
+Added: 7.61.0
+---
+Enables the automatic use of bold font styles when writing HTTP headers to the
+terminal. Use --no-styled-output to switch them off.
diff --git a/docs/cmdline-opts/tftp-blksize.d b/docs/cmdline-opts/tftp-blksize.d
index 04c6c53b6..c184328de 100644
--- a/docs/cmdline-opts/tftp-blksize.d
+++ b/docs/cmdline-opts/tftp-blksize.d
@@ -1,6 +1,6 @@
 Long: tftp-blksize
 Arg: <value>
-help: Set TFTP BLKSIZE option
+Help: Set TFTP BLKSIZE option
 Protocols: TFTP
 Added: 7.20.0
 ---
diff --git a/docs/cmdline-opts/tls13-ciphers.d 
b/docs/cmdline-opts/tls13-ciphers.d
new file mode 100644
index 000000000..add161595
--- /dev/null
+++ b/docs/cmdline-opts/tls13-ciphers.d
@@ -0,0 +1,12 @@
+Long: tls13-ciphers
+Arg: <list of TLS 1.3 ciphersuites>
+help: TLS 1.3 cipher suites to use
+Protocols: TLS
+---
+Specifies which cipher suites to use in the connection if it negotiates TLS
+1.3. The list of ciphers suites must specify valid ciphers. Read up on TLS 1.3
+cipher suite details on this URL:
+
+ https://curl.haxx.se/docs/ssl-ciphers.html
+
+If this option is used several times, the last one will be used.
diff --git a/docs/cmdline-opts/tlsv1.1.d b/docs/cmdline-opts/tlsv1.1.d
index 9bfdc3536..a3c10edba 100644
--- a/docs/cmdline-opts/tlsv1.1.d
+++ b/docs/cmdline-opts/tlsv1.1.d
@@ -3,4 +3,4 @@ Help: Use TLSv1.1
 Protocols: TLS
 Added: 7.34.0
 ---
-Forces curl to use TLS version 1.1 when connecting to a remote TLS server.
+Forces curl to use TLS version 1.1 or later when connecting to a remote TLS 
server.
diff --git a/docs/cmdline-opts/tlsv1.2.d b/docs/cmdline-opts/tlsv1.2.d
index 6db94dc8d..8879546b7 100644
--- a/docs/cmdline-opts/tlsv1.2.d
+++ b/docs/cmdline-opts/tlsv1.2.d
@@ -3,4 +3,4 @@ Help: Use TLSv1.2
 Protocols: TLS
 Added: 7.34.0
 ---
-Forces curl to use TLS version 1.2 when connecting to a remote TLS server.
+Forces curl to use TLS version 1.2 or later when connecting to a remote TLS 
server.
diff --git a/docs/cmdline-opts/tlsv1.3.d b/docs/cmdline-opts/tlsv1.3.d
index 123589653..cf32e3928 100644
--- a/docs/cmdline-opts/tlsv1.3.d
+++ b/docs/cmdline-opts/tlsv1.3.d
@@ -3,7 +3,7 @@ Help: Use TLSv1.3
 Protocols: TLS
 Added: 7.52.0
 ---
-Forces curl to use TLS version 1.3 when connecting to a remote TLS server.
+Forces curl to use TLS version 1.3 or later when connecting to a remote TLS 
server.
 
 Note that TLS 1.3 is only supported by a subset of TLS backends. At the time
 of this writing, they are BoringSSL, NSS, and Secure Transport (on iOS 11 or
diff --git a/docs/cmdline-opts/tlsv1.d b/docs/cmdline-opts/tlsv1.d
index 9c9f6b3f5..4cb405697 100644
--- a/docs/cmdline-opts/tlsv1.d
+++ b/docs/cmdline-opts/tlsv1.d
@@ -8,5 +8,5 @@ Requires: TLS
 See-also: http1.1 http2
 Help: Use TLSv1.0 or greater
 ---
-Tells curl to use TLS version 1.x when negotiating with a remote TLS
-server. That means TLS version 1.0, 1.1 or 1.2.
+Tells curl to use at least TLS version 1.x when negotiating with a remote TLS
+server. That means TLS version 1.0 or higher
diff --git a/docs/cmdline-opts/url.d b/docs/cmdline-opts/url.d
index c54e1ea85..ce52cdf06 100644
--- a/docs/cmdline-opts/url.d
+++ b/docs/cmdline-opts/url.d
@@ -1,4 +1,4 @@
-long: url
+Long: url
 Arg: <url>
 Help: URL to work with
 ---
diff --git a/docs/examples/Makefile.inc b/docs/examples/Makefile.inc
index e8aa9fa68..9215b82fb 100644
--- a/docs/examples/Makefile.inc
+++ b/docs/examples/Makefile.inc
@@ -43,4 +43,4 @@ COMPLICATED_EXAMPLES = curlgtk.c curlx.c htmltitle.cpp 
cacertinmem.c  \
   sampleconv.c synctime.c threaded-ssl.c evhiperfifo.c                 \
   smooth-gtk-thread.c version-check.pl href_extractor.c asiohiper.cpp  \
   multi-uv.c xmlstream.c usercertinmem.c sessioninfo.c                 \
-  threaded-shared-conn.c
+  threaded-shared-conn.c crawler.c
diff --git a/docs/examples/Makefile.netware b/docs/examples/Makefile.netware
index e75d143d5..9ff6d9498 100644
--- a/docs/examples/Makefile.netware
+++ b/docs/examples/Makefile.netware
@@ -136,7 +136,7 @@ endif
        CFLAGS += -align 4
 else
        # PRELUDE = $(NDK_CLIB)/imports/clibpre.o
-       # to avoid the __init_* / __deinit_* whoes don't use prelude from NDK
+       # to avoid the __init_* / __deinit_* woes don't use prelude from NDK
        PRELUDE = "$(MWCW_PATH)/libraries/runtime/prelude.obj"
        # CFLAGS += -include "$(MWCW_PATH)/headers/nlm_clib_prefix.h"
        CFLAGS += -align 1
@@ -159,7 +159,7 @@ else
 endif
 else
        # PRELUDE = $(NDK_CLIB)/imports/clibpre.gcc.o
-       # to avoid the __init_* / __deinit_* whoes don't use prelude from NDK
+       # to avoid the __init_* / __deinit_* woes don't use prelude from NDK
        # http://www.gknw.net/development/mk_nlm/gcc_pre.zip
        PRELUDE = $(NDK_ROOT)/pre/prelude.o
        CFLAGS += -include $(NDKBASE)/nlmconv/genlm.h
diff --git a/docs/examples/cacertinmem.c b/docs/examples/cacertinmem.c
index ffac53e1c..ec72c7a71 100644
--- a/docs/examples/cacertinmem.c
+++ b/docs/examples/cacertinmem.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+ * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -111,7 +111,7 @@ err:
 
     fprintf(stderr, "error adding certificate\n");
     if(error) {
-      ERR_error_string_n(error, errbuf, sizeof errbuf);
+      ERR_error_string_n(error, errbuf, sizeof(errbuf));
       fprintf(stderr, "%s\n", errbuf);
     }
   }
diff --git a/docs/examples/chkspeed.c b/docs/examples/chkspeed.c
index 5c032db8b..7a53ff3a4 100644
--- a/docs/examples/chkspeed.c
+++ b/docs/examples/chkspeed.c
@@ -165,33 +165,37 @@ int main(int argc, char *argv[])
   res = curl_easy_perform(curl_handle);
 
   if(CURLE_OK == res) {
-    double val;
+    curl_off_t val;
 
     /* check for bytes downloaded */
-    res = curl_easy_getinfo(curl_handle, CURLINFO_SIZE_DOWNLOAD, &val);
+    res = curl_easy_getinfo(curl_handle, CURLINFO_SIZE_DOWNLOAD_T, &val);
     if((CURLE_OK == res) && (val>0))
-      printf("Data downloaded: %0.0f bytes.\n", val);
+      printf("Data downloaded: %" CURL_FORMAT_CURL_OFF_T " bytes.\n", val);
 
     /* check for total download time */
-    res = curl_easy_getinfo(curl_handle, CURLINFO_TOTAL_TIME, &val);
+    res = curl_easy_getinfo(curl_handle, CURLINFO_TOTAL_TIME_T, &val);
     if((CURLE_OK == res) && (val>0))
-      printf("Total download time: %0.3f sec.\n", val);
+      printf("Total download time: %" CURL_FORMAT_CURL_OFF_T ".%06ld sec.\n",
+             (val / 1000000), (long)(val % 1000000));
 
     /* check for average download speed */
-    res = curl_easy_getinfo(curl_handle, CURLINFO_SPEED_DOWNLOAD, &val);
+    res = curl_easy_getinfo(curl_handle, CURLINFO_SPEED_DOWNLOAD_T, &val);
     if((CURLE_OK == res) && (val>0))
-      printf("Average download speed: %0.3f kbyte/sec.\n", val / 1024);
+      printf("Average download speed: %" CURL_FORMAT_CURL_OFF_T
+             " kbyte/sec.\n", val / 1024);
 
     if(prtall) {
       /* check for name resolution time */
-      res = curl_easy_getinfo(curl_handle, CURLINFO_NAMELOOKUP_TIME, &val);
+      res = curl_easy_getinfo(curl_handle, CURLINFO_NAMELOOKUP_TIME_T, &val);
       if((CURLE_OK == res) && (val>0))
-        printf("Name lookup time: %0.3f sec.\n", val);
+        printf("Name lookup time: %" CURL_FORMAT_CURL_OFF_T ".%06ld sec.\n",
+               (val / 1000000), (long)(val % 1000000));
 
       /* check for connect time */
-      res = curl_easy_getinfo(curl_handle, CURLINFO_CONNECT_TIME, &val);
+      res = curl_easy_getinfo(curl_handle, CURLINFO_CONNECT_TIME_T, &val);
       if((CURLE_OK == res) && (val>0))
-        printf("Connect time: %0.3f sec.\n", val);
+        printf("Connect time: %" CURL_FORMAT_CURL_OFF_T ".%06ld sec.\n",
+               (val / 1000000), (long)(val % 1000000));
     }
   }
   else {
diff --git a/docs/examples/crawler.c b/docs/examples/crawler.c
new file mode 100644
index 000000000..946177486
--- /dev/null
+++ b/docs/examples/crawler.c
@@ -0,0 +1,210 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Web crawler based on curl and libxml2.
+ * Copyright (C) 2018 Jeroen Ooms <address@hidden>
+ * License: MIT
+ *
+ * To compile:
+ *   gcc crawler.c $(pkg-config --cflags --libs libxml-2.0 libcurl)
+ *
+ */
+/* <DESC>
+ * Web crawler based on curl and libxml2 to stress-test curl with
+ * hundreds of concurrent connections to various servers.
+ * </DESC>
+ */
+
+/* Parameters */
+int max_con = 200;
+int max_total = 20000;
+int max_requests = 500;
+int max_link_per_page = 5;
+int follow_relative_links = 0;
+char *start_page = "https://www.reuters.com";;
+
+#include <libxml/HTMLparser.h>
+#include <libxml/xpath.h>
+#include <libxml/uri.h>
+#include <gnurl/curl.h>
+#include <stdlib.h>
+#include <string.h>
+#include <math.h>
+#include <signal.h>
+
+int pending_interrupt = 0;
+void sighandler(int dummy)
+{
+  pending_interrupt = 1;
+}
+
+/* resizable buffer */
+typedef struct {
+  char *buf;
+  size_t size;
+} memory;
+
+size_t grow_buffer(void *contents, size_t sz, size_t nmemb, void *ctx)
+{
+  size_t realsize = sz * nmemb;
+  memory *mem = (memory*) ctx;
+  mem->buf = realloc(mem->buf, mem->size + realsize);
+  memcpy(&(mem->buf[mem->size]), contents, realsize);
+  mem->size += realsize;
+  return realsize;
+}
+
+CURL *make_handle(char *url)
+{
+  CURL *handle = curl_easy_init();
+
+  /* Important: use HTTP2 over HTTPS */
+  curl_easy_setopt(handle, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2TLS);
+  curl_easy_setopt(handle, CURLOPT_URL, url);
+
+  /* buffer body */
+  memory *mem = malloc(sizeof(memory));
+  mem->size = 0;
+  mem->buf = malloc(1);
+  curl_easy_setopt(handle, CURLOPT_WRITEFUNCTION, grow_buffer);
+  curl_easy_setopt(handle, CURLOPT_WRITEDATA, mem);
+  curl_easy_setopt(handle, CURLOPT_PRIVATE, mem);
+
+  /* For completeness */
+  curl_easy_setopt(handle, CURLOPT_ENCODING, "gzip, deflate");
+  curl_easy_setopt(handle, CURLOPT_TIMEOUT, 5L);
+  curl_easy_setopt(handle, CURLOPT_FOLLOWLOCATION, 1L);
+  curl_easy_setopt(handle, CURLOPT_MAXREDIRS, 10L);
+  curl_easy_setopt(handle, CURLOPT_CONNECTTIMEOUT, 2L);
+  curl_easy_setopt(handle, CURLOPT_COOKIEFILE, "");
+  curl_easy_setopt(handle, CURLOPT_FILETIME, 1L);
+  curl_easy_setopt(handle, CURLOPT_USERAGENT, "mini crawler");
+  curl_easy_setopt(handle, CURLOPT_HTTPAUTH, CURLAUTH_ANY);
+  curl_easy_setopt(handle, CURLOPT_UNRESTRICTED_AUTH, 1L);
+  curl_easy_setopt(handle, CURLOPT_PROXYAUTH, CURLAUTH_ANY);
+  curl_easy_setopt(handle, CURLOPT_EXPECT_100_TIMEOUT_MS, 0L);
+  return handle;
+}
+
+/* HREF finder implemented in libxml2 but could be any HTML parser */
+size_t follow_links(CURLM *multi_handle, memory *mem, char *url)
+{
+  int opts = HTML_PARSE_NOBLANKS | HTML_PARSE_NOERROR | \
+             HTML_PARSE_NOWARNING | HTML_PARSE_NONET;
+  htmlDocPtr doc = htmlReadMemory(mem->buf, mem->size, url, NULL, opts);
+  if(!doc)
+    return 0;
+  xmlChar *xpath = (xmlChar*) "//a/@href";
+  xmlXPathContextPtr context = xmlXPathNewContext(doc);
+  xmlXPathObjectPtr result = xmlXPathEvalExpression(xpath, context);
+  xmlXPathFreeContext(context);
+  if(!result)
+    return 0;
+  xmlNodeSetPtr nodeset = result->nodesetval;
+  if(xmlXPathNodeSetIsEmpty(nodeset)) {
+    xmlXPathFreeObject(result);
+    return 0;
+  }
+  size_t count = 0;
+  for(int i = 0; i < nodeset->nodeNr; i++) {
+    double r = rand();
+    int x = r * nodeset->nodeNr / RAND_MAX;
+    const xmlNode *node = nodeset->nodeTab[x]->xmlChildrenNode;
+    xmlChar *href = xmlNodeListGetString(doc, node, 1);
+    if(follow_relative_links) {
+      xmlChar *orig = href;
+      href = xmlBuildURI(href, (xmlChar *) url);
+      xmlFree(orig);
+    }
+    char *link = (char *) href;
+    if(!link || strlen(link) < 20)
+      continue;
+    if(!strncmp(link, "http://";, 7) || !strncmp(link, "https://";, 8)) {
+      curl_multi_add_handle(multi_handle, make_handle(link));
+      if(count++ == max_link_per_page)
+        break;
+    }
+    xmlFree(link);
+  }
+  xmlXPathFreeObject(result);
+  return count;
+}
+
+int is_html(char *ctype)
+{
+  return ctype != NULL && strlen(ctype) > 10 && strstr(ctype, "text/html");
+}
+
+int main(void)
+{
+  signal(SIGINT, sighandler);
+  LIBXML_TEST_VERSION;
+  curl_global_init(CURL_GLOBAL_DEFAULT);
+  CURLM *multi_handle = curl_multi_init();
+  curl_multi_setopt(multi_handle, CURLMOPT_MAX_TOTAL_CONNECTIONS, max_con);
+  curl_multi_setopt(multi_handle, CURLMOPT_MAX_HOST_CONNECTIONS, 6L);
+
+  /* enables http/2 if available */
+  #ifdef CURLPIPE_MULTIPLEX
+    curl_multi_setopt(multi_handle, CURLMOPT_PIPELINING, CURLPIPE_MULTIPLEX);
+  #endif
+
+  /* sets html start page */
+  curl_multi_add_handle(multi_handle, make_handle(start_page));
+
+  int msgs_left;
+  int pending = 0;
+  int complete = 0;
+  int still_running = 1;
+  while(still_running && !pending_interrupt) {
+    int numfds;
+    curl_multi_wait(multi_handle, NULL, 0, 1000, &numfds);
+    curl_multi_perform(multi_handle, &still_running);
+
+    /* See how the transfers went */
+    CURLMsg *m = NULL;
+    while((m = curl_multi_info_read(multi_handle, &msgs_left))) {
+      if(m->msg == CURLMSG_DONE) {
+        CURL *handle = m->easy_handle;
+        char *url;
+        memory *mem;
+        curl_easy_getinfo(handle, CURLINFO_PRIVATE, &mem);
+        curl_easy_getinfo(handle, CURLINFO_EFFECTIVE_URL, &url);
+        if(m->data.result == CURLE_OK) {
+          long res_status;
+          curl_easy_getinfo(handle, CURLINFO_RESPONSE_CODE, &res_status);
+          if(res_status == 200) {
+            char *ctype;
+            curl_easy_getinfo(handle, CURLINFO_CONTENT_TYPE, &ctype);
+            printf("[%d] HTTP 200 (%s): %s\n", complete, ctype, url);
+            if(is_html(ctype) && mem->size > 100) {
+              if(pending < max_requests && (complete + pending) < max_total) {
+                pending += follow_links(multi_handle, mem, url);
+                still_running = 1;
+              }
+            }
+          }
+          else {
+            printf("[%d] HTTP %d: %s\n", complete, (int) res_status, url);
+          }
+        }
+        else {
+          printf("[%d] Connection failure: %s\n", complete, url);
+        }
+        curl_multi_remove_handle(multi_handle, handle);
+        curl_easy_cleanup(handle);
+        free(mem->buf);
+        free(mem);
+        complete++;
+        pending--;
+      }
+    }
+  }
+  curl_multi_cleanup(multi_handle);
+  curl_global_cleanup();
+  return 0;
+}
diff --git a/docs/examples/curlx.c b/docs/examples/curlx.c
index ccf91efae..e976548e0 100644
--- a/docs/examples/curlx.c
+++ b/docs/examples/curlx.c
@@ -159,7 +159,7 @@ static char *ia5string(ASN1_IA5STRING *ia5)
   return tmp;
 }
 
-/* A conveniance routine to get an access URI. */
+/* A convenience routine to get an access URI. */
 static unsigned char *my_get_ext(X509 *cert, const int type,
                                  int extensiontype)
 {
diff --git a/docs/examples/debug.c b/docs/examples/debug.c
index 5f5a67bb5..87047f1e8 100644
--- a/docs/examples/debug.c
+++ b/docs/examples/debug.c
@@ -45,11 +45,11 @@ void dump(const char *text,
     width = 0x40;
 
   fprintf(stream, "%s, %10.10lu bytes (0x%8.8lx)\n",
-          text, size, size);
+          text, (unsigned long)size, (unsigned long)size);
 
   for(i = 0; i<size; i += width) {
 
-    fprintf(stream, "%4.4lx: ", i);
+    fprintf(stream, "%4.4lx: ", (unsigned long)i);
 
     if(!nohex) {
       /* hex not disabled, show it */
diff --git a/docs/examples/fileupload.c b/docs/examples/fileupload.c
index aa4fbb127..71692a524 100644
--- a/docs/examples/fileupload.c
+++ b/docs/examples/fileupload.c
@@ -33,7 +33,7 @@ int main(void)
   CURL *curl;
   CURLcode res;
   struct stat file_info;
-  double speed_upload, total_time;
+  curl_off_t speed_upload, total_time;
   FILE *fd;
 
   fd = fopen("debugit", "rb"); /* open file to upload */
@@ -72,11 +72,13 @@ int main(void)
     }
     else {
       /* now extract transfer info */
-      curl_easy_getinfo(curl, CURLINFO_SPEED_UPLOAD, &speed_upload);
-      curl_easy_getinfo(curl, CURLINFO_TOTAL_TIME, &total_time);
+      curl_easy_getinfo(curl, CURLINFO_SPEED_UPLOAD_T, &speed_upload);
+      curl_easy_getinfo(curl, CURLINFO_TOTAL_TIME_T, &total_time);
 
-      fprintf(stderr, "Speed: %.3f bytes/sec during %.3f seconds\n",
-              speed_upload, total_time);
+      fprintf(stderr, "Speed: %" CURL_FORMAT_CURL_OFF_T " bytes/sec during %"
+              CURL_FORMAT_CURL_OFF_T ".%06ld seconds\n",
+              speed_upload,
+              (total_time / 1000000), (long)(total_time % 1000000));
 
     }
     /* always cleanup */
diff --git a/docs/examples/getinmemory.c b/docs/examples/getinmemory.c
index bda3c538d..11cb84194 100644
--- a/docs/examples/getinmemory.c
+++ b/docs/examples/getinmemory.c
@@ -100,7 +100,7 @@ int main(void)
      * Do something nice with it!
      */
 
-    printf("%lu bytes retrieved\n", chunk.size);
+    printf("%lu bytes retrieved\n", (unsigned long)chunk.size);
   }
 
   /* cleanup curl stuff */
diff --git a/docs/examples/http2-download.c b/docs/examples/http2-download.c
index 38e873d4f..b12004bc5 100644
--- a/docs/examples/http2-download.c
+++ b/docs/examples/http2-download.c
@@ -72,11 +72,11 @@ void dump(const char *text, int num, unsigned char *ptr, 
size_t size,
     width = 0x40;
 
   fprintf(stderr, "%d %s, %lu bytes (0x%lx)\n",
-          num, text, size, size);
+          num, text, (unsigned long)size, (unsigned long)size);
 
   for(i = 0; i<size; i += width) {
 
-    fprintf(stderr, "%4.4lx: ", i);
+    fprintf(stderr, "%4.4lx: ", (unsigned long)i);
 
     if(!nohex) {
       /* hex not disabled, show it */
diff --git a/docs/examples/http2-serverpush.c b/docs/examples/http2-serverpush.c
index 411f169ab..f7fc13c59 100644
--- a/docs/examples/http2-serverpush.c
+++ b/docs/examples/http2-serverpush.c
@@ -52,11 +52,11 @@ void dump(const char *text, unsigned char *ptr, size_t size,
     width = 0x40;
 
   fprintf(stderr, "%s, %lu bytes (0x%lx)\n",
-          text, size, size);
+          text, (unsigned long)size, (unsigned long)size);
 
   for(i = 0; i<size; i += width) {
 
-    fprintf(stderr, "%4.4lx: ", i);
+    fprintf(stderr, "%4.4lx: ", (unsigned long)i);
 
     if(!nohex) {
       /* hex not disabled, show it */
@@ -181,11 +181,11 @@ static int server_push_callback(CURL *parent,
   curl_easy_setopt(easy, CURLOPT_WRITEDATA, out);
 
   fprintf(stderr, "**** push callback approves stream %u, got %lu headers!\n",
-          count, num_headers);
+          count, (unsigned long)num_headers);
 
   for(i = 0; i<num_headers; i++) {
     headp = curl_pushheader_bynum(headers, i);
-    fprintf(stderr, "**** header %lu: %s\n", i, headp);
+    fprintf(stderr, "**** header %lu: %s\n", (unsigned long)i, headp);
   }
 
   headp = curl_pushheader_byname(headers, ":path");
diff --git a/docs/examples/http2-upload.c b/docs/examples/http2-upload.c
index 95bf861f4..81080eca7 100644
--- a/docs/examples/http2-upload.c
+++ b/docs/examples/http2-upload.c
@@ -73,11 +73,11 @@ void dump(const char *text, int num, unsigned char *ptr, 
size_t size,
     width = 0x40;
 
   fprintf(stderr, "%d %s, %lu bytes (0x%lx)\n",
-          num, text, size, size);
+          num, text, (unsigned long)size, (unsigned long)size);
 
   for(i = 0; i<size; i += width) {
 
-    fprintf(stderr, "%4.4lx: ", i);
+    fprintf(stderr, "%4.4lx: ", (unsigned long)i);
 
     if(!nohex) {
       /* hex not disabled, show it */
diff --git a/docs/examples/multi-debugcallback.c 
b/docs/examples/multi-debugcallback.c
index c4f340d11..a1aa21a9b 100644
--- a/docs/examples/multi-debugcallback.c
+++ b/docs/examples/multi-debugcallback.c
@@ -52,11 +52,11 @@ void dump(const char *text,
     width = 0x40;
 
   fprintf(stream, "%s, %10.10lu bytes (0x%8.8lx)\n",
-          text, size, size);
+          text, (unsigned long)size, (unsigned long)size);
 
   for(i = 0; i<size; i += width) {
 
-    fprintf(stream, "%4.4lx: ", i);
+    fprintf(stream, "%4.4lx: ", (unsigned long)i);
 
     if(!nohex) {
       /* hex not disabled, show it */
diff --git a/docs/examples/multi-uv.c b/docs/examples/multi-uv.c
index d40446836..e532e1231 100644
--- a/docs/examples/multi-uv.c
+++ b/docs/examples/multi-uv.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2016, Daniel Stenberg, <address@hidden>, et al.
+ * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -50,7 +50,7 @@ static curl_context_t* create_curl_context(curl_socket_t 
sockfd)
 {
   curl_context_t *context;
 
-  context = (curl_context_t *) malloc(sizeof *context);
+  context = (curl_context_t *) malloc(sizeof(*context));
 
   context->sockfd = sockfd;
 
diff --git a/docs/examples/progressfunc.c b/docs/examples/progressfunc.c
index b21a79e77..080b4df3a 100644
--- a/docs/examples/progressfunc.c
+++ b/docs/examples/progressfunc.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2016, Daniel Stenberg, <address@hidden>, et al.
+ * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -27,11 +27,25 @@
 #include <stdio.h>
 #include <gnurl/curl.h>
 
-#define STOP_DOWNLOAD_AFTER_THIS_MANY_BYTES         6000
+#if LIBCURL_VERSION_NUM >= 0x073d00
+/* In libcurl 7.61.0, support was added for extracting the time in plain
+   microseconds. Older libcurl versions are stuck in using 'double' for this
+   information so we complicate this example a bit by supporting either
+   approach. */
+#define TIME_IN_US 1 /* microseconds */
+#define TIMETYPE curl_off_t
+#define TIMEOPT CURLINFO_TOTAL_TIME_T
+#define MINIMAL_PROGRESS_FUNCTIONALITY_INTERVAL     3000000
+#else
+#define TIMETYPE double
+#define TIMEOPT CURLINFO_TOTAL_TIME
 #define MINIMAL_PROGRESS_FUNCTIONALITY_INTERVAL     3
+#endif
+
+#define STOP_DOWNLOAD_AFTER_THIS_MANY_BYTES         6000
 
 struct myprogress {
-  double lastruntime;
+  TIMETYPE lastruntime; /* type depends on version, see above */
   CURL *curl;
 };
 
@@ -42,16 +56,21 @@ static int xferinfo(void *p,
 {
   struct myprogress *myp = (struct myprogress *)p;
   CURL *curl = myp->curl;
-  double curtime = 0;
+  TIMETYPE curtime = 0;
 
-  curl_easy_getinfo(curl, CURLINFO_TOTAL_TIME, &curtime);
+  curl_easy_getinfo(curl, TIMEOPT, &curtime);
 
   /* under certain circumstances it may be desirable for certain functionality
      to only run every N seconds, in order to do this the transaction time can
      be used */
   if((curtime - myp->lastruntime) >= MINIMAL_PROGRESS_FUNCTIONALITY_INTERVAL) {
     myp->lastruntime = curtime;
+#ifdef TIME_IN_US
+    fprintf(stderr, "TOTAL TIME: %" CURL_FORMAT_CURL_OFF_T ".%06ld\r\n",
+            (curtime / 1000000), (long)(curtime % 1000000));
+#else
     fprintf(stderr, "TOTAL TIME: %f \r\n", curtime);
+#endif
   }
 
   fprintf(stderr, "UP: %" CURL_FORMAT_CURL_OFF_T " of %" CURL_FORMAT_CURL_OFF_T
@@ -64,6 +83,7 @@ static int xferinfo(void *p,
   return 0;
 }
 
+#if LIBCURL_VERSION_NUM < 0x072000
 /* for libcurl older than 7.32.0 (CURLOPT_PROGRESSFUNCTION) */
 static int older_progress(void *p,
                           double dltotal, double dlnow,
@@ -75,7 +95,7 @@ static int older_progress(void *p,
                   (curl_off_t)ultotal,
                   (curl_off_t)ulnow);
 }
-
+#endif
 
 int main(void)
 {
@@ -90,10 +110,6 @@ int main(void)
 
     curl_easy_setopt(curl, CURLOPT_URL, "http://example.com/";);
 
-    curl_easy_setopt(curl, CURLOPT_PROGRESSFUNCTION, older_progress);
-    /* pass the struct pointer into the progress function */
-    curl_easy_setopt(curl, CURLOPT_PROGRESSDATA, &prog);
-
 #if LIBCURL_VERSION_NUM >= 0x072000
     /* xferinfo was introduced in 7.32.0, no earlier libcurl versions will
        compile as they won't have the symbols around.
@@ -109,6 +125,10 @@ int main(void)
     /* pass the struct pointer into the xferinfo function, note that this is
        an alias to CURLOPT_PROGRESSDATA */
     curl_easy_setopt(curl, CURLOPT_XFERINFODATA, &prog);
+#else
+    curl_easy_setopt(curl, CURLOPT_PROGRESSFUNCTION, older_progress);
+    /* pass the struct pointer into the progress function */
+    curl_easy_setopt(curl, CURLOPT_PROGRESSDATA, &prog);
 #endif
 
     curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 0L);
diff --git a/docs/examples/smtp-mime.c b/docs/examples/smtp-mime.c
index 71e2d56b1..38a0a06d7 100644
--- a/docs/examples/smtp-mime.c
+++ b/docs/examples/smtp-mime.c
@@ -107,7 +107,7 @@ int main(void)
     /* Build the mime message. */
     mime = curl_mime_init(curl);
 
-    /* The inline part is an alterative proposing the html and the text
+    /* The inline part is an alternative proposing the html and the text
        versions of the e-mail. */
     alt = curl_mime_init(curl);
 
diff --git a/docs/examples/threaded-shared-conn.c 
b/docs/examples/threaded-shared-conn.c
index 8402603b1..3babdaad5 100644
--- a/docs/examples/threaded-shared-conn.c
+++ b/docs/examples/threaded-shared-conn.c
@@ -107,7 +107,7 @@ static void *run_thread(void *ptr)
     curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_db);
     curl_easy_perform(curl); /* ignores error */
     curl_easy_cleanup(curl);
-    fprintf(stderr, "Tread %d transfer %d\n", u->threadno, i);
+    fprintf(stderr, "Thread %d transfer %d\n", u->threadno, i);
   }
 
   return NULL;
diff --git a/docs/libcurl/gnurl_easy_getinfo.3 
b/docs/libcurl/gnurl_easy_getinfo.3
index 351a6b8d9..a85d47f6f 100644
--- a/docs/libcurl/gnurl_easy_getinfo.3
+++ b/docs/libcurl/gnurl_easy_getinfo.3
@@ -60,24 +60,45 @@ Remote time of the retrieved document. See 
\fICURLINFO_FILETIME_T(3)\fP
 .IP CURLINFO_TOTAL_TIME
 Total time of previous transfer.
 See \fICURLINFO_TOTAL_TIME(3)\fP
+.IP CURLINFO_TOTAL_TIME_T
+Total time of previous transfer.
+See \fICURLINFO_TOTAL_TIME_T(3)\fP
 .IP CURLINFO_NAMELOOKUP_TIME
 Time from start until name resolving completed.
 See \fICURLINFO_NAMELOOKUP_TIME(3)\fP
+.IP CURLINFO_NAMELOOKUP_TIME_T
+Time from start until name resolving completed.
+See \fICURLINFO_NAMELOOKUP_TIME_T(3)\fP
 .IP CURLINFO_CONNECT_TIME
 Time from start until remote host or proxy completed.
 See \fICURLINFO_CONNECT_TIME(3)\fP
+.IP CURLINFO_CONNECT_TIME_T
+Time from start until remote host or proxy completed.
+See \fICURLINFO_CONNECT_TIME_T(3)\fP
 .IP CURLINFO_APPCONNECT_TIME
 Time from start until SSL/SSH handshake completed.
 See \fICURLINFO_APPCONNECT_TIME(3)\fP
+.IP CURLINFO_APPCONNECT_TIME_T
+Time from start until SSL/SSH handshake completed.
+See \fICURLINFO_APPCONNECT_TIME_T(3)\fP
 .IP CURLINFO_PRETRANSFER_TIME
 Time from start until just before the transfer begins.
 See \fICURLINFO_PRETRANSFER_TIME(3)\fP
+.IP CURLINFO_PRETRANSFER_TIME_T
+Time from start until just before the transfer begins.
+See \fICURLINFO_PRETRANSFER_TIME_T(3)\fP
 .IP CURLINFO_STARTTRANSFER_TIME
 Time from start until just when the first byte is received.
 See \fICURLINFO_STARTTRANSFER_TIME(3)\fP
+.IP CURLINFO_STARTTRANSFER_TIME_T
+Time from start until just when the first byte is received.
+See \fICURLINFO_STARTTRANSFER_TIME_T(3)\fP
 .IP CURLINFO_REDIRECT_TIME
 Time taken for all redirect steps before the final transfer.
 See \fICURLINFO_REDIRECT_TIME(3)\fP
+.IP CURLINFO_REDIRECT_TIME_T
+Time taken for all redirect steps before the final transfer.
+See \fICURLINFO_REDIRECT_TIME_T(3)\fP
 .IP CURLINFO_REDIRECT_COUNT
 Total number of redirects that were followed.
 See \fICURLINFO_REDIRECT_COUNT(3)\fP
@@ -221,25 +242,32 @@ curl_easy_perform()
     |--|--|--|--|--|--REDIRECT
 .fi
 .IP NAMELOOKUP
-\fICURLINFO_NAMELOOKUP_TIME\fP. The time it took from the start until the name
-resolving was completed.
+\fICURLINFO_NAMELOOKUP_TIME\fP and \fIfICURLINFO_NAMELOOKUP_TIME_T\fP.
+The time it took from the start until the name resolving was completed.
 .IP CONNECT
-\fICURLINFO_CONNECT_TIME\fP. The time it took from the start until the connect
+\fICURLINFO_CONNECT_TIME\fP and \fICURLINFO_CONNECT_TIME_T\fP.
+The time it took from the start until the connect
 to the remote host (or proxy) was completed.
 .IP APPCONNECT
-\fICURLINFO_APPCONNECT_TIME\fP. The time it took from the start until the SSL
-connect/handshake with the remote host was completed. (Added in in 7.19.0)
+\fICURLINFO_APPCONNECT_TIME\fP and \fICURLINFO_APPCONNECT_TIME_T\fP.
+The time it took from the start until the SSL
+connect/handshake with the remote host was completed. (Added in 7.19.0)
+The latter is the integer version (measuring microseconds).  (Added in 7.60.0)
 .IP PRETRANSFER
-\fICURLINFO_PRETRANSFER_TIME\fP. The time it took from the start until the
+\fICURLINFO_PRETRANSFER_TIME\fP and \fICURLINFO_PRETRANSFER_TIME_T\fP.
+The time it took from the start until the
 file transfer is just about to begin. This includes all pre-transfer commands
 and negotiations that are specific to the particular protocol(s) involved.
 .IP STARTTRANSFER
-\fICURLINFO_STARTTRANSFER_TIME\fP. The time it took from the start until the
+\fICURLINFO_STARTTRANSFER_TIME\fP and \fICURLINFO_STARTTRANSFER_TIME_T\fP.
+The time it took from the start until the
 first byte is received by libcurl.
 .IP TOTAL
-\fICURLINFO_TOTAL_TIME\fP. Total time of the previous request.
+\fICURLINFO_TOTAL_TIME\fP and \fICURLINFO_TOTAL_TIME_T\fP.
+Total time of the previous request.
 .IP REDIRECT
-\fICURLINFO_REDIRECT_TIME\fP. The time it took for all redirection steps
+\fICURLINFO_REDIRECT_TIME\fP and \fICURLINFO_REDIRECT_TIME_T\fP.
+The time it took for all redirection steps
 include name lookup, connect, pretransfer and transfer before final
 transaction was started. So, this is zero if no redirection took place.
 .SH RETURN VALUE
diff --git a/docs/libcurl/gnurl_easy_setopt.3 b/docs/libcurl/gnurl_easy_setopt.3
index 50983a647..7b7cba8da 100644
--- a/docs/libcurl/gnurl_easy_setopt.3
+++ b/docs/libcurl/gnurl_easy_setopt.3
@@ -186,7 +186,7 @@ Socks5 GSSAPI NEC mode. See 
\fICURLOPT_SOCKS5_GSSAPI_NEC(3)\fP
 .IP CURLOPT_PROXY_SERVICE_NAME
 Proxy authentication service name. \fICURLOPT_PROXY_SERVICE_NAME(3)\fP
 .IP CURLOPT_HAPROXYPROTOCOL
-Send an HAProxy PROXY protocol header. See \fICURLOPT_HAPROXYPROTOCOL(3)\fP
+Send an HAProxy PROXY protocol v1 header. See \fICURLOPT_HAPROXYPROTOCOL(3)\fP
 .IP CURLOPT_SERVICE_NAME
 Authentication service name. \fICURLOPT_SERVICE_NAME(3)\fP
 .IP CURLOPT_INTERFACE
@@ -258,6 +258,8 @@ HTTP proxy authentication methods. See 
\fICURLOPT_PROXYAUTH(3)\fP
 Enable SASL initial response. See \fICURLOPT_SASL_IR(3)\fP
 .IP CURLOPT_XOAUTH2_BEARER
 OAuth2 bearer token. See \fICURLOPT_XOAUTH2_BEARER(3)\fP
+.IP CURLOPT_DISALLOW_USERNAME_IN_URL
+Don't allow username in URL. See \fICURLOPT_DISALLOW_USERNAME_IN_URL(3)\fP
 .SH HTTP OPTIONS
 .IP CURLOPT_AUTOREFERER
 Automatically set Referer: header. See \fICURLOPT_AUTOREFERER(3)\fP
@@ -548,6 +550,10 @@ Identify EGD socket for entropy. See 
\fICURLOPT_EGDSOCKET(3)\fP
 Ciphers to use. See \fICURLOPT_SSL_CIPHER_LIST(3)\fP
 .IP CURLOPT_PROXY_SSL_CIPHER_LIST
 Proxy ciphers to use. See \fICURLOPT_PROXY_SSL_CIPHER_LIST(3)\fP
+.IP CURLOPT_TLS13_CIPHERS
+TLS 1.3 cipher suites to use. See \fICURLOPT_TLS13_CIPHERS(3)\fP
+.IP CURLOPT_PROXY_TLS13_CIPHERS
+Proxy TLS 1.3 cipher suites to use. See \fICURLOPT_PROXY_TLS13_CIPHERS(3)\fP
 .IP CURLOPT_SSL_SESSIONID_CACHE
 Disable SSL session-id cache. See \fICURLOPT_SSL_SESSIONID_CACHE(3)\fP
 .IP CURLOPT_SSL_OPTIONS
diff --git a/docs/libcurl/gnurl_multi_add_handle.3 
b/docs/libcurl/gnurl_multi_add_handle.3
index ec6f6c934..959474d4d 100644
--- a/docs/libcurl/gnurl_multi_add_handle.3
+++ b/docs/libcurl/gnurl_multi_add_handle.3
@@ -5,7 +5,7 @@
 .\" *                            | (__| |_| |  _ <| |___
 .\" *                             \___|\___/|_| \_\_____|
 .\" *
-.\" * Copyright (C) 1998 - 2014, Daniel Stenberg, <address@hidden>, et al.
+.\" * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
 .\" *
 .\" * This software is licensed as described in the file COPYING, which
 .\" * you should have received as part of this distribution. The terms
@@ -46,11 +46,11 @@ connection cache owned by the multi handle. Removing and 
adding new easy
 handles will not affect the pool of connections or the ability to do
 connection re-use.
 
-If you have CURLMOPT_TIMERFUNCTION set in the multi handle (and you really
-should if you're working event-based with \fIcurl_multi_socket_action(3)\fP
-and friends), that callback will be called from within this function to ask
-for an updated timer so that your main event loop will get the activity on
-this handle to get started.
+If you have \fICURLMOPT_TIMERFUNCTION(3)\fP set in the multi handle (and you
+really should if you're working event-based with
+\fIcurl_multi_socket_action(3)\fP and friends), that callback will be called
+from within this function to ask for an updated timer so that your main event
+loop will get the activity on this handle to get started.
 
 The easy handle will remain added to the multi handle until you remove it
 again with \fIcurl_multi_remove_handle(3)\fP - even when a transfer with that
diff --git a/docs/libcurl/gnurl_multi_socket.3 
b/docs/libcurl/gnurl_multi_socket.3
index c477069c9..a2f7339fd 100644
--- a/docs/libcurl/gnurl_multi_socket.3
+++ b/docs/libcurl/gnurl_multi_socket.3
@@ -5,7 +5,7 @@
 .\" *                            | (__| |_| |  _ <| |___
 .\" *                             \___|\___/|_| \_\_____|
 .\" *
-.\" * Copyright (C) 1998 - 2016, Daniel Stenberg, <address@hidden>, et al.
+.\" * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
 .\" *
 .\" * This software is licensed as described in the file COPYING, which
 .\" * you should have received as part of this distribution. The terms
@@ -45,12 +45,13 @@ which easy handle that completed.
 
 The \fIcurl_multi_socket_action(3)\fP functions inform the application about
 updates in the socket (file descriptor) status by doing none, one, or multiple
-calls to the socket callback function set with the CURLMOPT_SOCKETFUNCTION
-option to \fIcurl_multi_setopt(3)\fP. They update the status with changes
-since the previous time the callback was called.
+calls to the socket callback function set with the
+\fICURLMOPT_SOCKETFUNCTION(3)\fP option to \fIcurl_multi_setopt(3)\fP. They
+update the status with changes since the previous time the callback was
+called.
 
-Get the timeout time by setting the \fICURLMOPT_TIMERFUNCTION\fP option with
-\fIcurl_multi_setopt(3)\fP. Your application will then get called with
+Get the timeout time by setting the \fICURLMOPT_TIMERFUNCTION(3)\fP option
+with \fIcurl_multi_setopt(3)\fP. Your application will then get called with
 information on how long to wait for socket actions at most before doing the
 timeout action: call the \fIcurl_multi_socket_action(3)\fP function with the
 \fBsockfd\fP argument set to CURL_SOCKET_TIMEOUT. You can also use the
@@ -107,7 +108,7 @@ service to applications that want to keep certain data or 
structs that are
 strictly associated to the given socket.
 
 The \fIuserp\fP argument is a private pointer you have previously set with
-\fIcurl_multi_setopt(3)\fP and the CURLMOPT_SOCKETDATA option.
+\fIcurl_multi_setopt(3)\fP and the \fICURLMOPT_SOCKETDATA(3)\fP option.
 .SH "RETURN VALUE"
 CURLMcode type, general libcurl multi interface error code.
 
@@ -127,10 +128,10 @@ return OK.
 .SH "TYPICAL USAGE"
 1. Create a multi handle
 
-2. Set the socket callback with CURLMOPT_SOCKETFUNCTION
+2. Set the socket callback with \fICURLMOPT_SOCKETFUNCTION(3)\fP
 
-3. Set the timeout callback with CURLMOPT_TIMERFUNCTION, to get to know what
-timeout value to use when waiting for socket activities.
+3. Set the timeout callback with \fICURLMOPT_TIMERFUNCTION(3)\fP, to get to
+know what timeout value to use when waiting for socket activities.
 
 4. Add easy handles with curl_multi_add_handle()
 
diff --git a/docs/libcurl/gnurl_multi_socket_action.3 
b/docs/libcurl/gnurl_multi_socket_action.3
index ba8c5ee21..ad84c1e66 100644
--- a/docs/libcurl/gnurl_multi_socket_action.3
+++ b/docs/libcurl/gnurl_multi_socket_action.3
@@ -5,7 +5,7 @@
 .\" *                            | (__| |_| |  _ <| |___
 .\" *                             \___|\___/|_| \_\_____|
 .\" *
-.\" * Copyright (C) 1998 - 2016, Daniel Stenberg, <address@hidden>, et al.
+.\" * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
 .\" *
 .\" * This software is licensed as described in the file COPYING, which
 .\" * you should have received as part of this distribution. The terms
@@ -111,7 +111,7 @@ service to applications that want to keep certain data or 
structs that are
 strictly associated to the given socket.
 
 The \fIuserp\fP argument is a private pointer you have previously set with
-\fIcurl_multi_setopt(3)\fP and the CURLMOPT_SOCKETDATA option.
+\fIcurl_multi_setopt(3)\fP and the \fICURLMOPT_SOCKETDATA(3)\fP option.
 .SH "RETURN VALUE"
 CURLMcode type, general libcurl multi interface error code.
 
@@ -128,10 +128,10 @@ functions return OK.
 .SH "TYPICAL USAGE"
 1. Create a multi handle
 
-2. Set the socket callback with CURLMOPT_SOCKETFUNCTION
+2. Set the socket callback with \fICURLMOPT_SOCKETFUNCTION(3)\fP
 
-3. Set the timeout callback with CURLMOPT_TIMERFUNCTION, to get to know what
-timeout value to use when waiting for socket activities.
+3. Set the timeout callback with \fICURLMOPT_TIMERFUNCTION(3)\fP, to get to
+know what timeout value to use when waiting for socket activities.
 
 4. Add easy handles with curl_multi_add_handle()
 
diff --git a/docs/libcurl/gnurl_share_setopt.3 
b/docs/libcurl/gnurl_share_setopt.3
index 31ce44a19..8c2fe91ed 100644
--- a/docs/libcurl/gnurl_share_setopt.3
+++ b/docs/libcurl/gnurl_share_setopt.3
@@ -87,6 +87,15 @@ existed before this.
 
 Note that when you use the multi interface, all easy handles added to the same
 multi handle will share connection cache by default without using this option.
+.IP CURL_LOCK_DATA_PSL
+The Public Suffix List stored in the share object is made available to all
+easy handle bound to the later. Since the Public Suffix List is periodically
+refreshed, this avoids updates in too many different contexts.
+
+\fBCURL_LOCK_DATA_PSL\fP exists since 7.61.0.
+
+Note that when you use the multi interface, all easy handles added to the same
+multi handle will share PSL cache by default without using this option.
 .RE
 .IP CURLSHOPT_UNSHARE
 This option does the opposite of \fICURLSHOPT_SHARE\fP. It specifies that
diff --git a/docs/libcurl/libgnurl-multi.3 b/docs/libcurl/libgnurl-multi.3
index 76f8c3620..96013552f 100644
--- a/docs/libcurl/libgnurl-multi.3
+++ b/docs/libcurl/libgnurl-multi.3
@@ -5,7 +5,7 @@
 .\" *                            | (__| |_| |  _ <| |___
 .\" *                             \___|\___/|_| \_\_____|
 .\" *
-.\" * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+.\" * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
 .\" *
 .\" * This software is licensed as described in the file COPYING, which
 .\" * you should have received as part of this distribution. The terms
@@ -132,24 +132,24 @@ using large numbers of simultaneous connections.
 
 When using this API, you add easy handles to the multi handle just as with the
 normal multi interface. Then you also set two callbacks with the
-CURLMOPT_SOCKETFUNCTION and CURLMOPT_TIMERFUNCTION options to
-\fIcurl_multi_setopt(3)\fP. They are two callback functions that libcurl will
-call with information about what sockets to wait for, and for what activity,
-and what the current timeout time is - if that expires libcurl should be
-notified.
+\fICURLMOPT_SOCKETFUNCTION(3)\fP and \fICURLMOPT_TIMERFUNCTION(3)\fP options
+to \fIcurl_multi_setopt(3)\fP. They are two callback functions that libcurl
+will call with information about what sockets to wait for, and for what
+activity, and what the current timeout time is - if that expires libcurl
+should be notified.
 
 The multi_socket API is designed to inform your application about which
 sockets libcurl is currently using and for what activities (read and/or write)
 on those sockets your application is expected to wait for.
 
 Your application must make sure to receive all sockets informed about in the
-CURLMOPT_SOCKETFUNCTION callback and make sure it reacts on the given activity
-on them. When a socket has the given activity, you call
+\fICURLMOPT_SOCKETFUNCTION(3)\fP callback and make sure it reacts on the given
+activity on them. When a socket has the given activity, you call
 \fIcurl_multi_socket_action(3)\fP specifying which socket and action there
 are.
 
-The CURLMOPT_TIMERFUNCTION callback is called to set a timeout. When that
-timeout expires, your application should call the
+The \fICURLMOPT_TIMERFUNCTION(3)\fP callback is called to set a timeout. When
+that timeout expires, your application should call the
 \fIcurl_multi_socket_action(3)\fP function saying it was due to a timeout.
 
 This API is typically used with an event-driven underlying functionality (like
diff --git a/docs/libcurl/libgnurl-security.3 b/docs/libcurl/libgnurl-security.3
index 25ae400fe..79952d314 100644
--- a/docs/libcurl/libgnurl-security.3
+++ b/docs/libcurl/libgnurl-security.3
@@ -88,9 +88,11 @@ have been injected by an attacker. The data that curl sends 
might be modified
 before it reaches the intended server. If it even reaches the intended server
 at all.
 
-Remedies include:
- - Restrict operations to authenticated transfers
- - Make sure the server's certificate etc is verified
+Remedies:
+.IP "Restrict operations to authenticated transfers"
+Ie use authenticated protocols protected with HTTPS or SSH.
+.IP "Make sure the server's certificate etc is verified"
+Never ever switch off certificate verification.
 .SH "Redirects"
 The \fICURLOPT_FOLLOWLOCATION(3)\fP option automatically follows HTTP
 redirects sent by a remote server.  These redirects can refer to any kind of
@@ -233,11 +235,13 @@ particular scheme in the URL but point to a server doing 
a different protocol
 on a non-standard port.
 
 Remedies:
-
- - curl command lines can use \fI--proto\fP to limit what schemes it accepts
- - libcurl programs can use \fICURLOPT_PROTOCOLS(3)\fP
- - consider not allowing the user to set the full URL
- - consider strictly filtering input to only allow specific choices
+.IP "Use --proto"
+curl command lines can use \fI--proto\fP to limit what URL schemes it accepts
+.IP "Use CURLOPT_PROTOCOLS"
+libcurl programs can use \fICURLOPT_PROTOCOLS(3)\fP to limit what URL schemes 
it accepts
+.IP "consider not allowing the user to set the full URL"
+Maybe just let the user provide data for parts of it? Or maybe filter input to
+only allow specific choices?
 .SH "RFC 3986 vs WHATWG URL"
 curl supports URLs mostly according to how they are defined in RFC 3986, and
 has done so since the beginning.
@@ -317,8 +321,8 @@ one. HTTPS without validated certificates is potentially as 
insecure as a
 plain HTTP connection.
 .SH "Report Security Problems"
 Should you detect or just suspect a security problem in libcurl or curl,
-contact the project curl security team immediately. See the separate
-SECURITY.md document for details.
+contact the project curl security team immediately. See
+https://curl.haxx.se/dev/secprocess.html for details.
 .SH "Showing What You Do"
 Relatedly, be aware that in situations when you have problems with libcurl and
 ask someone for help, everything you reveal in order to get best possible help
diff --git a/docs/libcurl/opts/GNURLINFO_APPCONNECT_TIME.3 
b/docs/libcurl/opts/GNURLINFO_APPCONNECT_TIME.3
index 1af8c4333..c0eadb821 100644
--- a/docs/libcurl/opts/GNURLINFO_APPCONNECT_TIME.3
+++ b/docs/libcurl/opts/GNURLINFO_APPCONNECT_TIME.3
@@ -59,4 +59,4 @@ Added in 7.19.0
 .SH RETURN VALUE
 Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
 .SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
+.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), " 
CURLINFO_APPCONNECT_TIME_T "(3)"
diff --git a/docs/libcurl/opts/GNURLINFO_APPCONNECT_TIME.3 
b/docs/libcurl/opts/GNURLINFO_APPCONNECT_TIME_T.3
similarity index 73%
copy from docs/libcurl/opts/GNURLINFO_APPCONNECT_TIME.3
copy to docs/libcurl/opts/GNURLINFO_APPCONNECT_TIME_T.3
index 1af8c4333..bc8908035 100644
--- a/docs/libcurl/opts/GNURLINFO_APPCONNECT_TIME.3
+++ b/docs/libcurl/opts/GNURLINFO_APPCONNECT_TIME_T.3
@@ -5,7 +5,7 @@
 .\" *                            | (__| |_| |  _ <| |___
 .\" *                             \___|\___/|_| \_\_____|
 .\" *
-.\" * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+.\" * Copyright (C) 2018, Daniel Stenberg, <address@hidden>, et al.
 .\" *
 .\" * This software is licensed as described in the file COPYING, which
 .\" * you should have received as part of this distribution. The terms
@@ -20,17 +20,18 @@
 .\" *
 .\" **************************************************************************
 .\"
-.TH CURLINFO_APPCONNECT_TIME 3 "28 Aug 2015" "libcurl 7.44.0" 
"curl_easy_getinfo options"
+.TH CURLINFO_APPCONNECT_TIME_T 3 "28 Apr 2018" "libcurl 7.61.0" 
"curl_easy_getinfo options"
 .SH NAME
-CURLINFO_APPCONNECT_TIME \- get the time until the SSL/SSH handshake is 
completed
+CURLINFO_APPCONNECT_TIME_T \- get the time until the SSL/SSH handshake is 
completed
 .SH SYNOPSIS
 #include <gnurl/curl.h>
 
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_APPCONNECT_TIME, double 
*timep);
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_APPCONNECT_TIME_T, 
curl_off_t *timep);
 .SH DESCRIPTION
-Pass a pointer to a double to receive the time, in seconds, it took from the
+Pass a pointer to a curl_off_t to receive the time, in microseconds,
+it took from the
 start until the SSL/SSH connect/handshake to the remote host was completed.
-This time is most often very near to the \fICURLINFO_PRETRANSFER_TIME(3)\fP
+This time is most often very near to the \fICURLINFO_PRETRANSFER_TIME_T(3)\fP
 time, except for cases such as HTTP pipelining where the pretransfer time can
 be delayed due to waits in line for the pipeline and more.
 
@@ -41,13 +42,14 @@ All
 .nf
 curl = curl_easy_init();
 if(curl) {
-  double connect;
+  curl_off_t connect;
   curl_easy_setopt(curl, CURLOPT_URL, url);
   res = curl_easy_perform(curl);
   if(CURLE_OK == res) {
-    res = curl_easy_getinfo(curl, CURLINFO_APPCONNECT_TIME, &connect);
+    res = curl_easy_getinfo(curl, CURLINFO_APPCONNECT_TIME_T, &connect);
     if(CURLE_OK == res) {
-      printf("Time: %.1f", connect);
+      printf("Time: %" CURL_FORMAT_CURL_OFF_T ".%06ld", connect / 1000000,
+             (long)(connect % 1000000));
     }
   }
   /* always cleanup */
@@ -55,8 +57,8 @@ if(curl) {
 }
 .fi
 .SH AVAILABILITY
-Added in 7.19.0
+Added in 7.61.0
 .SH RETURN VALUE
 Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
 .SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
+.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), " 
CURLINFO_APPCONNECT_TIME "(3)"
diff --git a/docs/libcurl/opts/GNURLINFO_CONNECT_TIME.3 
b/docs/libcurl/opts/GNURLINFO_CONNECT_TIME.3
index d3ff00214..107553702 100644
--- a/docs/libcurl/opts/GNURLINFO_CONNECT_TIME.3
+++ b/docs/libcurl/opts/GNURLINFO_CONNECT_TIME.3
@@ -56,4 +56,4 @@ Added in 7.4.1
 .SH RETURN VALUE
 Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
 .SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
+.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), " CURLINFO_CONNECT_TIME_T 
"(3)"
diff --git a/docs/libcurl/opts/GNURLINFO_CONNECT_TIME.3 
b/docs/libcurl/opts/GNURLINFO_CONNECT_TIME_T.3
similarity index 67%
copy from docs/libcurl/opts/GNURLINFO_CONNECT_TIME.3
copy to docs/libcurl/opts/GNURLINFO_CONNECT_TIME_T.3
index d3ff00214..9871aec17 100644
--- a/docs/libcurl/opts/GNURLINFO_CONNECT_TIME.3
+++ b/docs/libcurl/opts/GNURLINFO_CONNECT_TIME_T.3
@@ -5,7 +5,7 @@
 .\" *                            | (__| |_| |  _ <| |___
 .\" *                             \___|\___/|_| \_\_____|
 .\" *
-.\" * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+.\" * Copyright (C) 2018, Daniel Stenberg, <address@hidden>, et al.
 .\" *
 .\" * This software is licensed as described in the file COPYING, which
 .\" * you should have received as part of this distribution. The terms
@@ -20,17 +20,16 @@
 .\" *
 .\" **************************************************************************
 .\"
-.TH CURLINFO_CONNECT_TIME 3 "28 Aug 2015" "libcurl 7.44.0" "curl_easy_getinfo 
options"
+.TH CURLINFO_CONNECT_TIME_T 3 "28 Apr 2018" "libcurl 7.61.0" 
"curl_easy_getinfo options"
 .SH NAME
-CURLINFO_CONNECT_TIME \- get the time until connect
+CURLINFO_CONNECT_TIME_T \- get the time until connect
 .SH SYNOPSIS
 #include <gnurl/curl.h>
 
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_CONNECT_TIME, double *timep);
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_CONNECT_TIME_T, curl_off_t 
*timep);
 .SH DESCRIPTION
-Pass a pointer to a double to receive the total time in seconds from the start
-until the connection to the remote host (or proxy) was completed.
-
+Pass a pointer to a curl_off_t to receive the total time in microseconds
+from the start until the connection to the remote host (or proxy) was 
completed.
 See also the TIMES overview in the \fIcurl_easy_getinfo(3)\fP man page.
 .SH PROTOCOLS
 All
@@ -38,13 +37,14 @@ All
 .nf
 curl = curl_easy_init();
 if(curl) {
-  double connect;
+  curl_off_t connect;
   curl_easy_setopt(curl, CURLOPT_URL, url);
   res = curl_easy_perform(curl);
   if(CURLE_OK == res) {
-    res = curl_easy_getinfo(curl, CURLINFO_CONNECT_TIME, &connect);
+    res = curl_easy_getinfo(curl, CURLINFO_CONNECT_TIME_T, &connect);
     if(CURLE_OK == res) {
-      printf("Time: %.1f", connect);
+      printf("Time: %" CURL_FORMAT_CURL_OFF_T ".%06ld", connect / 1000000,
+             (long)(connect % 1000000));
     }
   }
   /* always cleanup */
@@ -52,8 +52,8 @@ if(curl) {
 }
 .fi
 .SH AVAILABILITY
-Added in 7.4.1
+Added in 7.61.0
 .SH RETURN VALUE
 Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
 .SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
+.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), " CURLINFO_CONNECT_TIME 
"(3)"
diff --git a/docs/libcurl/opts/GNURLINFO_NAMELOOKUP_TIME.3 
b/docs/libcurl/opts/GNURLINFO_NAMELOOKUP_TIME.3
index 407b2c709..84dd96e1f 100644
--- a/docs/libcurl/opts/GNURLINFO_NAMELOOKUP_TIME.3
+++ b/docs/libcurl/opts/GNURLINFO_NAMELOOKUP_TIME.3
@@ -56,4 +56,4 @@ Added in 7.4.1
 .SH RETURN VALUE
 Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
 .SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
+.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), " 
CURLINFO_NAMELOOKUP_TIME_T "(3)"
diff --git a/docs/libcurl/opts/GNURLINFO_NAMELOOKUP_TIME.3 
b/docs/libcurl/opts/GNURLINFO_NAMELOOKUP_TIME_T.3
similarity index 69%
copy from docs/libcurl/opts/GNURLINFO_NAMELOOKUP_TIME.3
copy to docs/libcurl/opts/GNURLINFO_NAMELOOKUP_TIME_T.3
index 407b2c709..f1150f2da 100644
--- a/docs/libcurl/opts/GNURLINFO_NAMELOOKUP_TIME.3
+++ b/docs/libcurl/opts/GNURLINFO_NAMELOOKUP_TIME_T.3
@@ -5,7 +5,7 @@
 .\" *                            | (__| |_| |  _ <| |___
 .\" *                             \___|\___/|_| \_\_____|
 .\" *
-.\" * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+.\" * Copyright (C) 2018, Daniel Stenberg, <address@hidden>, et al.
 .\" *
 .\" * This software is licensed as described in the file COPYING, which
 .\" * you should have received as part of this distribution. The terms
@@ -20,16 +20,16 @@
 .\" *
 .\" **************************************************************************
 .\"
-.TH CURLINFO_NAMELOOKUP_TIME 3 "28 Aug 2015" "libcurl 7.44.0" 
"curl_easy_getinfo options"
+.TH CURLINFO_NAMELOOKUP_TIME_T 3 "28 Apr 2018" "libcurl 7.61.0" 
"curl_easy_getinfo options"
 .SH NAME
-CURLINFO_NAMELOOKUP_TIME \- get the name lookup time
+CURLINFO_NAMELOOKUP_TIME_T \- get the name lookup time in microseconds
 .SH SYNOPSIS
 #include <gnurl/curl.h>
 
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_NAMELOOKUP_TIME, double 
*timep);
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_NAMELOOKUP_TIME_T, 
curl_off_t *timep);
 .SH DESCRIPTION
-Pass a pointer to a double to receive the total time in seconds from the start
-until the name resolving was completed.
+Pass a pointer to a curl_off_t to receive the total time in microseconds
+from the start until the name resolving was completed.
 
 See also the TIMES overview in the \fIcurl_easy_getinfo(3)\fP man page.
 .SH PROTOCOLS
@@ -38,13 +38,14 @@ All
 .nf
 curl = curl_easy_init();
 if(curl) {
-  double namelookup;
+  curl_off_t namelookup;
   curl_easy_setopt(curl, CURLOPT_URL, url);
   res = curl_easy_perform(curl);
   if(CURLE_OK == res) {
-    res = curl_easy_getinfo(curl, CURLINFO_NAMELOOKUP_TIME, &namelookup);
+    res = curl_easy_getinfo(curl, CURLINFO_NAMELOOKUP_TIME_T, &namelookup);
     if(CURLE_OK == res) {
-      printf("Time: %.1f", namelookup);
+      printf("Time: %" CURL_FORMAT_CURL_OFF_T ".%06ld", namelookup / 1000000,
+             (long)(namelookup % 1000000));
     }
   }
   /* always cleanup */
@@ -52,8 +53,8 @@ if(curl) {
 }
 .fi
 .SH AVAILABILITY
-Added in 7.4.1
+Added in 7.61.0
 .SH RETURN VALUE
 Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
 .SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
+.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), " 
CURLINFO_NAMELOOKUP_TIME "(3)"
diff --git a/docs/libcurl/opts/GNURLINFO_PRETRANSFER_TIME.3 
b/docs/libcurl/opts/GNURLINFO_PRETRANSFER_TIME.3
index 461fcb931..17b99a4b7 100644
--- a/docs/libcurl/opts/GNURLINFO_PRETRANSFER_TIME.3
+++ b/docs/libcurl/opts/GNURLINFO_PRETRANSFER_TIME.3
@@ -59,4 +59,4 @@ Added in 7.4.1
 .SH RETURN VALUE
 Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
 .SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
+.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), " 
CURLINFO_PRETRANSFER_TIME_T "(3)"
diff --git a/docs/libcurl/opts/GNURLINFO_PRETRANSFER_TIME.3 
b/docs/libcurl/opts/GNURLINFO_PRETRANSFER_TIME_T.3
similarity index 73%
copy from docs/libcurl/opts/GNURLINFO_PRETRANSFER_TIME.3
copy to docs/libcurl/opts/GNURLINFO_PRETRANSFER_TIME_T.3
index 461fcb931..d63856a58 100644
--- a/docs/libcurl/opts/GNURLINFO_PRETRANSFER_TIME.3
+++ b/docs/libcurl/opts/GNURLINFO_PRETRANSFER_TIME_T.3
@@ -5,7 +5,7 @@
 .\" *                            | (__| |_| |  _ <| |___
 .\" *                             \___|\___/|_| \_\_____|
 .\" *
-.\" * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+.\" * Copyright (C) 2018, Daniel Stenberg, <address@hidden>, et al.
 .\" *
 .\" * This software is licensed as described in the file COPYING, which
 .\" * you should have received as part of this distribution. The terms
@@ -20,15 +20,16 @@
 .\" *
 .\" **************************************************************************
 .\"
-.TH CURLINFO_PRETRANSFER_TIME 3 "28 Aug 2015" "libcurl 7.44.0" 
"curl_easy_getinfo options"
+.TH CURLINFO_PRETRANSFER_TIME_T 3 "28 Apr 2018" "libcurl 7.61.0" 
"curl_easy_getinfo options"
 .SH NAME
-CURLINFO_PRETRANSFER_TIME \- get the time until the file transfer start
+CURLINFO_PRETRANSFER_TIME_T \- get the time until the file transfer start
 .SH SYNOPSIS
 #include <gnurl/curl.h>
 
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_PRETRANSFER_TIME, double 
*timep);
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_PRETRANSFER_TIME_T, 
curl_off_t *timep);
 .SH DESCRIPTION
-Pass a pointer to a double to receive the time, in seconds, it took from the
+Pass a pointer to a curl_off_t to receive the time, in microseconds,
+it took from the
 start until the file transfer is just about to begin. This includes all
 pre-transfer commands and negotiations that are specific to the particular
 protocol(s) involved. It does \fInot\fP involve the sending of the protocol-
@@ -41,13 +42,14 @@ All
 .nf
 curl = curl_easy_init();
 if(curl) {
-  double pretransfer;
+  curl_off_t pretransfer;
   curl_easy_setopt(curl, CURLOPT_URL, url);
   res = curl_easy_perform(curl);
   if(CURLE_OK == res) {
-    res = curl_easy_getinfo(curl, CURLINFO_PRETRANSFER_TIME, &pretransfer);
+    res = curl_easy_getinfo(curl, CURLINFO_PRETRANSFER_TIME_T, &pretransfer);
     if(CURLE_OK == res) {
-      printf("Time: %.1f", pretransfer);
+      printf("Time: %" CURL_FORMAT_CURL_OFF_T ".%06ld", pretransfer / 1000000,
+             (long)(pretransfer % 1000000));
     }
   }
   /* always cleanup */
@@ -55,8 +57,8 @@ if(curl) {
 }
 .fi
 .SH AVAILABILITY
-Added in 7.4.1
+Added in 7.61.0
 .SH RETURN VALUE
 Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
 .SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
+.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), " 
CURLINFO_PRETRANSFER_TIME "(3)"
diff --git a/docs/libcurl/opts/GNURLINFO_REDIRECT_TIME.3 
b/docs/libcurl/opts/GNURLINFO_REDIRECT_TIME.3
index a98d76df3..f7ccd541c 100644
--- a/docs/libcurl/opts/GNURLINFO_REDIRECT_TIME.3
+++ b/docs/libcurl/opts/GNURLINFO_REDIRECT_TIME.3
@@ -58,4 +58,4 @@ Added in 7.9.7
 .SH RETURN VALUE
 Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
 .SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
+.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), " 
CURLINFO_REDIRECT_TIME_T "(3)"
diff --git a/docs/libcurl/opts/GNURLINFO_REDIRECT_TIME.3 
b/docs/libcurl/opts/GNURLINFO_REDIRECT_TIME_T.3
similarity index 65%
copy from docs/libcurl/opts/GNURLINFO_REDIRECT_TIME.3
copy to docs/libcurl/opts/GNURLINFO_REDIRECT_TIME_T.3
index a98d76df3..922a1b50d 100644
--- a/docs/libcurl/opts/GNURLINFO_REDIRECT_TIME.3
+++ b/docs/libcurl/opts/GNURLINFO_REDIRECT_TIME_T.3
@@ -5,7 +5,7 @@
 .\" *                            | (__| |_| |  _ <| |___
 .\" *                             \___|\___/|_| \_\_____|
 .\" *
-.\" * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+.\" * Copyright (C) 2018, Daniel Stenberg, <address@hidden>, et al.
 .\" *
 .\" * This software is licensed as described in the file COPYING, which
 .\" * you should have received as part of this distribution. The terms
@@ -20,18 +20,19 @@
 .\" *
 .\" **************************************************************************
 .\"
-.TH CURLINFO_REDIRECT_TIME 3 "28 Aug 2015" "libcurl 7.44.0" "curl_easy_getinfo 
options"
+.TH CURLINFO_REDIRECT_TIME_T 3 "28 Apr 2018" "libcurl 7.61.0" 
"curl_easy_getinfo options"
 .SH NAME
-CURLINFO_REDIRECT_TIME \- get the time for all redirection steps
+CURLINFO_REDIRECT_TIME_T \- get the time for all redirection steps
 .SH SYNOPSIS
 #include <gnurl/curl.h>
 
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_REDIRECT_TIME, double 
*timep);
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_REDIRECT_TIME_T, curl_off_t 
*timep);
 .SH DESCRIPTION
-Pass a pointer to a double to receive the total time, in seconds, it took for
+Pass a pointer to a curl_off_t to receive the total time, in microseconds,
+it took for
 all redirection steps include name lookup, connect, pretransfer and transfer
-before final transaction was started. CURLINFO_REDIRECT_TIME contains the
-complete execution time for multiple redirections.
+before final transaction was started. \fICURLINFO_REDIRECT_TIME_T\fP contains
+the complete execution time for multiple redirections.
 
 See also the TIMES overview in the \fIcurl_easy_getinfo(3)\fP man page.
 .SH PROTOCOLS
@@ -40,13 +41,14 @@ All
 .nf
 curl = curl_easy_init();
 if(curl) {
-  double redirect;
+  curl_off_t redirect;
   curl_easy_setopt(curl, CURLOPT_URL, url);
   res = curl_easy_perform(curl);
   if(CURLE_OK == res) {
-    res = curl_easy_getinfo(curl, CURLINFO_REDIRECT_TIME, &redirect);
+    res = curl_easy_getinfo(curl, CURLINFO_REDIRECT_TIME_T, &redirect);
     if(CURLE_OK == res) {
-      printf("Time: %.1f", redirect);
+      printf("Time: %" CURL_FORMAT_CURL_OFF_T ".%06ld", redirect / 1000000,
+             (long)(redirect % 1000000));
     }
   }
   /* always cleanup */
@@ -54,8 +56,8 @@ if(curl) {
 }
 .fi
 .SH AVAILABILITY
-Added in 7.9.7
+Added in 7.61.0
 .SH RETURN VALUE
 Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
 .SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
+.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), " CURLINFO_REDIRECT_TIME 
"(3)"
diff --git a/docs/libcurl/opts/GNURLINFO_STARTTRANSFER_TIME.3 
b/docs/libcurl/opts/GNURLINFO_STARTTRANSFER_TIME.3
index 655d77219..6b72677e7 100644
--- a/docs/libcurl/opts/GNURLINFO_STARTTRANSFER_TIME.3
+++ b/docs/libcurl/opts/GNURLINFO_STARTTRANSFER_TIME.3
@@ -58,4 +58,4 @@ Added in 7.9.2
 .SH RETURN VALUE
 Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
 .SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
+.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), " 
CURLINFO_STARTTRANSFER_TIME_T "(3)"
diff --git a/docs/libcurl/opts/GNURLINFO_STARTTRANSFER_TIME.3 
b/docs/libcurl/opts/GNURLINFO_STARTTRANSFER_TIME_T.3
similarity index 69%
copy from docs/libcurl/opts/GNURLINFO_STARTTRANSFER_TIME.3
copy to docs/libcurl/opts/GNURLINFO_STARTTRANSFER_TIME_T.3
index 655d77219..73baaf473 100644
--- a/docs/libcurl/opts/GNURLINFO_STARTTRANSFER_TIME.3
+++ b/docs/libcurl/opts/GNURLINFO_STARTTRANSFER_TIME_T.3
@@ -5,7 +5,7 @@
 .\" *                            | (__| |_| |  _ <| |___
 .\" *                             \___|\___/|_| \_\_____|
 .\" *
-.\" * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+.\" * Copyright (C) 2018, Daniel Stenberg, <address@hidden>, et al.
 .\" *
 .\" * This software is licensed as described in the file COPYING, which
 .\" * you should have received as part of this distribution. The terms
@@ -20,17 +20,18 @@
 .\" *
 .\" **************************************************************************
 .\"
-.TH CURLINFO_STARTTRANSFER_TIME 3 "28 Aug 2015" "libcurl 7.44.0" 
"curl_easy_getinfo options"
+.TH CURLINFO_STARTTRANSFER_TIME_T 3 "28 Apr 2018" "libcurl 7.61.0" 
"curl_easy_getinfo options"
 .SH NAME
-CURLINFO_STARTTRANSFER_TIME \- get the time until the first byte is received
+CURLINFO_STARTTRANSFER_TIME_T \- get the time until the first byte is received
 .SH SYNOPSIS
 #include <gnurl/curl.h>
 
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_STARTTRANSFER_TIME, double 
*timep);
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_STARTTRANSFER_TIME_T, 
curl_off_t *timep);
 .SH DESCRIPTION
-Pass a pointer to a double to receive the time, in seconds, it took from the
+Pass a pointer to a curl_off_t to receive the time, in microseconds,
+it took from the
 start until the first byte is received by libcurl. This includes
-\fICURLINFO_PRETRANSFER_TIME(3)\fP and also the time the server needs to
+\fICURLINFO_PRETRANSFER_TIME_T(3)\fP and also the time the server needs to
 calculate the result.
 
 See also the TIMES overview in the \fIcurl_easy_getinfo(3)\fP man page.
@@ -40,13 +41,14 @@ All
 .nf
 curl = curl_easy_init();
 if(curl) {
-  double start;
+  curl_off_t start;
   curl_easy_setopt(curl, CURLOPT_URL, url);
   res = curl_easy_perform(curl);
   if(CURLE_OK == res) {
-    res = curl_easy_getinfo(curl, CURLINFO_STARTTRANSFER_TIME, &start);
+    res = curl_easy_getinfo(curl, CURLINFO_STARTTRANSFER_TIME_T, &start);
     if(CURLE_OK == res) {
-      printf("Time: %.1f", start);
+      printf("Time: %" CURL_FORMAT_CURL_OFF_T ".%06ld", start / 1000000,
+             (long)(start % 1000000));
     }
   }
   /* always cleanup */
@@ -54,8 +56,8 @@ if(curl) {
 }
 .fi
 .SH AVAILABILITY
-Added in 7.9.2
+Added in 7.61.0
 .SH RETURN VALUE
 Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
 .SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
+.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), " 
CURLINFO_STARTTRANSFER_TIME "(3)"
diff --git a/docs/libcurl/opts/GNURLINFO_TLS_SSL_PTR.3 
b/docs/libcurl/opts/GNURLINFO_TLS_SSL_PTR.3
index 5abd1f2ee..1973c43d3 100644
--- a/docs/libcurl/opts/GNURLINFO_TLS_SSL_PTR.3
+++ b/docs/libcurl/opts/GNURLINFO_TLS_SSL_PTR.3
@@ -5,7 +5,7 @@
 .\" *                            | (__| |_| |  _ <| |___
 .\" *                             \___|\___/|_| \_\_____|
 .\" *
-.\" * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+.\" * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
 .\" *
 .\" * This software is licensed as described in the file COPYING, which
 .\" * you should have received as part of this distribution. The terms
@@ -129,14 +129,33 @@ https://github.com/curl/curl/issues/685
 All TLS-based
 .SH EXAMPLE
 .nf
-CURL *curl = curl_easy_init();
-if(curl) {
+#include <gnurl/curl.h>
+#include <openssl/ssl.h>
+
+CURL *curl;
+static size_t wf(void *ptr, size_t size, size_t nmemb, void *stream)
+{
+  const struct curl_tlssessioninfo *info = NULL;
+  CURLcode res = curl_easy_getinfo(curl, CURLINFO_TLS_SSL_PTR, &info);
+  if(info && !res) {
+    if(CURLSSLBACKEND_OPENSSL == info->backend) {
+       printf("OpenSSL ver. %s\\n", SSL_get_version((SSL*)info->internals));
+    }
+  }
+  return size * nmemb;
+}
+
+int main(int argc, char** argv)
+{
   CURLcode res;
-  struct curl_tlssessioninfo *tls;
-  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com";);
-  res = curl_easy_perform(curl);
-  curl_easy_getinfo(curl, CURLINFO_TLS_SSL_PTR, &tls);
-  curl_easy_cleanup(curl);
+  curl = curl_easy_init();
+  if(curl) {
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com";);
+    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, wf);
+    res = curl_easy_perform(curl);
+    curl_easy_cleanup(curl);
+  }
+  return res;
 }
 .fi
 .SH AVAILABILITY
diff --git a/docs/libcurl/opts/GNURLINFO_TOTAL_TIME.3 
b/docs/libcurl/opts/GNURLINFO_TOTAL_TIME.3
index 6d8a6da55..83598f0ea 100644
--- a/docs/libcurl/opts/GNURLINFO_TOTAL_TIME.3
+++ b/docs/libcurl/opts/GNURLINFO_TOTAL_TIME.3
@@ -57,4 +57,4 @@ Added in 7.4.1
 .SH RETURN VALUE
 Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
 .SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
+.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), " CURLINFO_TOTAL_TIME_T 
"(3)"
diff --git a/docs/libcurl/opts/GNURLINFO_CONNECT_TIME.3 
b/docs/libcurl/opts/GNURLINFO_TOTAL_TIME_T.3
similarity index 66%
copy from docs/libcurl/opts/GNURLINFO_CONNECT_TIME.3
copy to docs/libcurl/opts/GNURLINFO_TOTAL_TIME_T.3
index d3ff00214..8f833f7e0 100644
--- a/docs/libcurl/opts/GNURLINFO_CONNECT_TIME.3
+++ b/docs/libcurl/opts/GNURLINFO_TOTAL_TIME_T.3
@@ -5,7 +5,7 @@
 .\" *                            | (__| |_| |  _ <| |___
 .\" *                             \___|\___/|_| \_\_____|
 .\" *
-.\" * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+.\" * Copyright (C) 2018, Daniel Stenberg, <address@hidden>, et al.
 .\" *
 .\" * This software is licensed as described in the file COPYING, which
 .\" * you should have received as part of this distribution. The terms
@@ -20,16 +20,17 @@
 .\" *
 .\" **************************************************************************
 .\"
-.TH CURLINFO_CONNECT_TIME 3 "28 Aug 2015" "libcurl 7.44.0" "curl_easy_getinfo 
options"
+.TH CURLINFO_TOTAL_TIME_T 3 "28 Apr 2018" "libcurl 7.61.0" "curl_easy_getinfo 
options"
 .SH NAME
-CURLINFO_CONNECT_TIME \- get the time until connect
+CURLINFO_TOTAL_TIME_T \- get total time of previous transfer in microseconds
 .SH SYNOPSIS
 #include <gnurl/curl.h>
 
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_CONNECT_TIME, double *timep);
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_TOTAL_TIME_T, curl_off_t 
*timep);
 .SH DESCRIPTION
-Pass a pointer to a double to receive the total time in seconds from the start
-until the connection to the remote host (or proxy) was completed.
+Pass a pointer to a curl_off_t to receive the total time in microseconds
+for the previous transfer, including name resolving, TCP connect etc.
+The curl_off_t represents the time in microseconds.
 
 See also the TIMES overview in the \fIcurl_easy_getinfo(3)\fP man page.
 .SH PROTOCOLS
@@ -38,13 +39,14 @@ All
 .nf
 curl = curl_easy_init();
 if(curl) {
-  double connect;
+  curl_off_t total;
   curl_easy_setopt(curl, CURLOPT_URL, url);
   res = curl_easy_perform(curl);
   if(CURLE_OK == res) {
-    res = curl_easy_getinfo(curl, CURLINFO_CONNECT_TIME, &connect);
+    res = curl_easy_getinfo(curl, CURLINFO_TOTAL_TIME_T, &total);
     if(CURLE_OK == res) {
-      printf("Time: %.1f", connect);
+      printf("Time: %" CURL_FORMAT_CURL_OFF_T ".%06ld", total / 1000000,
+             (long)(total % 1000000));
     }
   }
   /* always cleanup */
@@ -52,8 +54,8 @@ if(curl) {
 }
 .fi
 .SH AVAILABILITY
-Added in 7.4.1
+Added in 7.61.0
 .SH RETURN VALUE
 Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
 .SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
+.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), " CURLINFO_TOTAL_TIME 
"(3)"
diff --git a/docs/libcurl/opts/GNURLOPT_ACCEPT_ENCODING.3 
b/docs/libcurl/opts/GNURLOPT_ACCEPT_ENCODING.3
index b3af2c581..f5a0025cf 100644
--- a/docs/libcurl/opts/GNURLOPT_ACCEPT_ENCODING.3
+++ b/docs/libcurl/opts/GNURLOPT_ACCEPT_ENCODING.3
@@ -5,7 +5,7 @@
 .\" *                            | (__| |_| |  _ <| |___
 .\" *                             \___|\___/|_| \_\_____|
 .\" *
-.\" * Copyright (C) 1998 - 2016, Daniel Stenberg, <address@hidden>, et al.
+.\" * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
 .\" *
 .\" * This software is licensed as described in the file COPYING, which
 .\" * you should have received as part of this distribution. The terms
@@ -32,12 +32,20 @@ Pass a char * argument specifying what encoding you'd like.
 
 Sets the contents of the Accept-Encoding: header sent in an HTTP request, and
 enables decoding of a response when a Content-Encoding: header is received.
-Three encodings are supported: \fIidentity\fP, meaning non-compressed,
-\fIdeflate\fP which requests the server to compress its response using the
-zlib algorithm, and \fIgzip\fP which requests the gzip algorithm.
 
-If a zero-length string is set like "", then an Accept-Encoding: header
-containing all built-in supported encodings is sent.
+libcurl potentially supports several different compressed encodings depending
+on what support that has been built-in.
+
+To aid applications not having to bother about what specific algorithms this
+particular libcurl build supports, libcurl allows a zero-length string to be
+set ("") to ask for an Accept-Encoding: header to be used that contains all
+built-in supported encodings.
+
+Alternatively, you can specify exactly the encoding or list of encodings you
+want in the response. Four encodings are supported: \fIidentity\fP, meaning
+non-compressed, \fIdeflate\fP which requests the server to compress its
+response using the zlib algorithm, \fIgzip\fP which requests the gzip
+algorithm and (since curl 7.57.0) \fIbr\fP which is brotli.
 
 Set this option to NULL to explicitly disable it, which makes libcurl not send
 an Accept-Encoding: header and not decompress contents automatically.
diff --git a/docs/libcurl/opts/GNURLINFO_PRIMARY_PORT.3 
b/docs/libcurl/opts/GNURLOPT_DISALLOW_USERNAME_IN_URL.3
similarity index 63%
copy from docs/libcurl/opts/GNURLINFO_PRIMARY_PORT.3
copy to docs/libcurl/opts/GNURLOPT_DISALLOW_USERNAME_IN_URL.3
index 10ed5423f..8a4638a4c 100644
--- a/docs/libcurl/opts/GNURLINFO_PRIMARY_PORT.3
+++ b/docs/libcurl/opts/GNURLOPT_DISALLOW_USERNAME_IN_URL.3
@@ -5,7 +5,7 @@
 .\" *                            | (__| |_| |  _ <| |___
 .\" *                             \___|\___/|_| \_\_____|
 .\" *
-.\" * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+.\" * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
 .\" *
 .\" * This software is licensed as described in the file COPYING, which
 .\" * you should have received as part of this distribution. The terms
@@ -20,37 +20,37 @@
 .\" *
 .\" **************************************************************************
 .\"
-.TH CURLINFO_PRIMARY_PORT 3 "12 Sep 2015" "libcurl 7.44.0" "curl_easy_getinfo 
options"
+.TH CURLOPT_DISALLOW_USERNAME_IN_URL 3 "30 May 2018" "libcurl 7.61.0" 
"curl_easy_setopt options"
 .SH NAME
-CURLINFO_PRIMARY_PORT \- get the latest destination port number
+CURLOPT_DISALLOW_USERNAME_IN_URL \- disallow specifying username in the url
 .SH SYNOPSIS
 #include <gnurl/curl.h>
 
-CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_PRIMARY_PORT, long *portp);
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_DISALLOW_USERNAME_IN_URL, long 
disallow);
 .SH DESCRIPTION
-Pass a pointer to a long to receive the destination port of the most recent
-connection done with this \fBcurl\fP handle.
+A long parameter set to 1 tells the library to not allow URLs that include a
+username.
+.SH DEFAULT
+0 (disabled) - user names are allowed by default.
 .SH PROTOCOLS
-All
+Several
 .SH EXAMPLE
 .nf
 CURL *curl = curl_easy_init();
 if(curl) {
-  CURLcode res;
+
   curl_easy_setopt(curl, CURLOPT_URL, "http://example.com";);
-  res = curl_easy_perform(curl);
-  if(res == CURLE_OK) {
-    long port;
-    res = curl_easy_getinfo(curl, CURLINFO_PRIMARY_PORT, &port);
-    if(!res)
-      printf("Connected to remote port: %ld\\n", port);
-  }
-  curl_easy_cleanup(curl);
+  curl_easy_setopt(curl, CURLOPT_DISALLOW_USERNAME_IN_URL, 1L);
+
+  curl_easy_perform(curl);
 }
 .fi
 .SH AVAILABILITY
-Added in 7.21.0
+Added in libcurl 7.61.0
 .SH RETURN VALUE
 Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
+
+curl_easy_perform() will return CURLE_LOGIN_DENIED if this option is enabled
+and a URL containing a username is specified.
 .SH "SEE ALSO"
-.BR curl_easy_getinfo "(3), " curl_easy_setopt "(3), "
+.BR libcurl-security "(3), ", CURLOPT_PROTOCOLS "(3)"
diff --git a/docs/libcurl/opts/GNURLOPT_HAPROXYPROTOCOL.3 
b/docs/libcurl/opts/GNURLOPT_HAPROXYPROTOCOL.3
index c5c8f10a4..e1bc12dbf 100644
--- a/docs/libcurl/opts/GNURLOPT_HAPROXYPROTOCOL.3
+++ b/docs/libcurl/opts/GNURLOPT_HAPROXYPROTOCOL.3
@@ -5,7 +5,7 @@
 .\" *                            | (__| |_| |  _ <| |___
 .\" *                             \___|\___/|_| \_\_____|
 .\" *
-.\" * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+.\" * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
 .\" *
 .\" * This software is licensed as described in the file COPYING, which
 .\" * you should have received as part of this distribution. The terms
@@ -22,7 +22,7 @@
 .\"
 .TH CURLOPT_HAPROXYPROTOCOL 3 "5 Feb 2018" "libcurl 7.60.0" "curl_easy_setopt 
options"
 .SH NAME
-CURLOPT_HAPROXYPROTOCOL \- send HAProxy PROXY protocol header
+CURLOPT_HAPROXYPROTOCOL \- send HAProxy PROXY protocol v1 header
 .SH SYNOPSIS
 #include <gnurl/curl.h>
 
@@ -30,7 +30,7 @@ CURLcode curl_easy_setopt(CURL *handle, 
CURLOPT_HAPROXYPROTOCOL,
                           long haproxy_protocol);
 .SH DESCRIPTION
 A long parameter set to 1 tells the library to send an HAProxy PROXY
-protocol header at beginning of the connection. The default action is not to
+protocol v1 header at beginning of the connection. The default action is not to
 send this header.
 
 This option is primarily useful when sending test requests to a service that
@@ -38,7 +38,7 @@ expects this header.
 
 Most applications do not need this option.
 .SH DEFAULT
-0, do not send HAProxy PROXY protocol header
+0, do not send any HAProxy PROXY protocol header
 .SH PROTOCOLS
 HTTP
 .SH EXAMPLE
diff --git a/docs/libcurl/opts/GNURLOPT_HTTPAUTH.3 
b/docs/libcurl/opts/GNURLOPT_HTTPAUTH.3
index e9ee9de2e..c5897d65c 100644
--- a/docs/libcurl/opts/GNURLOPT_HTTPAUTH.3
+++ b/docs/libcurl/opts/GNURLOPT_HTTPAUTH.3
@@ -5,7 +5,7 @@
 .\" *                            | (__| |_| |  _ <| |___
 .\" *                             \___|\___/|_| \_\_____|
 .\" *
-.\" * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+.\" * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
 .\" *
 .\" * This software is licensed as described in the file COPYING, which
 .\" * you should have received as part of this distribution. The terms
@@ -56,6 +56,10 @@ defined in RFC2617 and is a more secure way to do 
authentication over public
 networks than the regular old-fashioned Basic method. The IE flavor is simply
 that libcurl will use a special "quirk" that IE is known to have used before
 version 7 and that some servers require the client to use.
+.IP CURLAUTH_BEARER
+HTTP Bearer token authentication, used primarily in OAuth 2.0 protocol.
+
+You can set the Bearer token to use with \fICURLOPT_XOAUTH2_BEARER(3)\fP.
 .IP CURLAUTH_NEGOTIATE
 HTTP Negotiate (SPNEGO) authentication. Negotiate authentication is defined
 in RFC 4559 and is the most secure way to perform authentication over HTTP.
@@ -118,6 +122,8 @@ CURLAUTH_DIGEST_IE was added in 7.19.3
 CURLAUTH_ONLY was added in 7.21.3
 
 CURLAUTH_NTLM_WB was added in 7.22.0
+
+CURLAUTH_BEARER was added in 7.61.0
 .SH RETURN VALUE
 Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
 CURLE_NOT_BUILT_IN if the bitmask specified no supported authentication
diff --git a/docs/libcurl/opts/GNURLOPT_HTTPGET.3 
b/docs/libcurl/opts/GNURLOPT_HTTPGET.3
index 071705683..f06cb7a87 100644
--- a/docs/libcurl/opts/GNURLOPT_HTTPGET.3
+++ b/docs/libcurl/opts/GNURLOPT_HTTPGET.3
@@ -5,7 +5,7 @@
 .\" *                            | (__| |_| |  _ <| |___
 .\" *                             \___|\___/|_| \_\_____|
 .\" *
-.\" * Copyright (C) 1998 - 2014, Daniel Stenberg, <address@hidden>, et al.
+.\" * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
 .\" *
 .\" * This software is licensed as described in the file COPYING, which
 .\" * you should have received as part of this distribution. The terms
@@ -34,6 +34,10 @@ same curl \fIhandle\fP.
 
 When setting \fICURLOPT_HTTPGET(3)\fP to 1, it will automatically set
 \fICURLOPT_NOBODY(3)\fP to 0 and \fICURLOPT_UPLOAD(3)\fP to 0.
+
+Setting this option to zero has no effect. Applications need to explicitly
+select which HTTP request method to use, they cannot deselect a method. To
+reset a handle to default method, consider \fIcurl_easy_reset(3)\fP.
 .SH DEFAULT
 0
 .SH PROTOCOLS
@@ -44,10 +48,10 @@ curl = curl_easy_init();
 if(curl) {
   curl_easy_setopt(curl, CURLOPT_URL, "http://example.com";);
 
-  /* use a GET to fetch this */ 
+  /* use a GET to fetch this */
   curl_easy_setopt(curl, CURLOPT_HTTPGET, 1L);
 
-  /* Perform the request */ 
+  /* Perform the request */
   curl_easy_perform(curl);
 }
 .fi
@@ -56,4 +60,5 @@ Along with HTTP
 .SH RETURN VALUE
 Returns CURLE_OK if HTTP is supported, and CURLE_UNKNOWN_OPTION if not.
 .SH "SEE ALSO"
-.BR CURLOPT_NOBODY "(3), " CURLOPT_UPLOAD "(3), "
+.BR CURLOPT_NOBODY "(3), " CURLOPT_UPLOAD "(3), " CURLOPT_POST "(3), "
+.BR curl_easy_reset "(3) "
diff --git a/docs/libcurl/opts/GNURLOPT_INTERFACE.3 
b/docs/libcurl/opts/GNURLOPT_INTERFACE.3
index be29fc034..16c7f358c 100644
--- a/docs/libcurl/opts/GNURLOPT_INTERFACE.3
+++ b/docs/libcurl/opts/GNURLOPT_INTERFACE.3
@@ -5,7 +5,7 @@
 .\" *                            | (__| |_| |  _ <| |___
 .\" *                             \___|\___/|_| \_\_____|
 .\" *
-.\" * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+.\" * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
 .\" *
 .\" * This software is licensed as described in the file COPYING, which
 .\" * you should have received as part of this distribution. The terms
@@ -41,6 +41,9 @@ multi interfaces to avoid allowing the code to block.  If 
"if!" is specified
 but the parameter does not match an existing interface, CURLE_INTERFACE_FAILED
 is returned from the libcurl function used to perform the transfer.
 
+libcurl does not support using network interface names for this option on
+Windows.
+
 The application does not have to keep the string around after setting this
 option.
 .SH DEFAULT
diff --git a/docs/libcurl/opts/GNURLOPT_POST.3 
b/docs/libcurl/opts/GNURLOPT_POST.3
index 727f36f5b..e9e1aa7fe 100644
--- a/docs/libcurl/opts/GNURLOPT_POST.3
+++ b/docs/libcurl/opts/GNURLOPT_POST.3
@@ -5,7 +5,7 @@
 .\" *                            | (__| |_| |  _ <| |___
 .\" *                             \___|\___/|_| \_\_____|
 .\" *
-.\" * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+.\" * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
 .\" *
 .\" * This software is licensed as described in the file COPYING, which
 .\" * you should have received as part of this distribution. The terms
@@ -57,8 +57,8 @@ adding a header like "Transfer-Encoding: chunked" with
 \fICURLOPT_HTTPHEADER(3)\fP. With HTTP 1.0 or without chunked transfer, you
 must specify the size in the request.
 
-When setting \fICURLOPT_POST(3)\fP to 1, it will automatically set
-\fICURLOPT_NOBODY(3)\fP to 0.
+When setting \fICURLOPT_POST(3)\fP to 1, libcurl will automatically set
+\fICURLOPT_NOBODY(3)\fP and \fICURLOPT_HTTPGET(3)\fP to 0.
 
 If you issue a POST request and then want to make a HEAD or GET using the same
 re-used handle, you must explicitly set the new request type using
diff --git a/docs/libcurl/opts/GNURLOPT_POSTFIELDS.3 
b/docs/libcurl/opts/GNURLOPT_POSTFIELDS.3
index a567ee1de..29ab06dac 100644
--- a/docs/libcurl/opts/GNURLOPT_POSTFIELDS.3
+++ b/docs/libcurl/opts/GNURLOPT_POSTFIELDS.3
@@ -5,7 +5,7 @@
 .\" *                            | (__| |_| |  _ <| |___
 .\" *                             \___|\___/|_| \_\_____|
 .\" *
-.\" * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+.\" * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
 .\" *
 .\" * This software is licensed as described in the file COPYING, which
 .\" * you should have received as part of this distribution. The terms
@@ -45,7 +45,7 @@ used by HTML forms. Change Content-Type with 
\fICURLOPT_HTTPHEADER(3)\fP.
 You can use \fIcurl_easy_escape(3)\fP to url-encode your data, if necessary. It
 returns a pointer to an encoded string that can be passed as \fIpostdata\fP.
 
-Using \fICURLOPT_POSTFIELDS(3)\fP implies \fICURLOPT_POST(3)\fP.
+Using \fICURLOPT_POSTFIELDS(3)\fP implies setting \fICURLOPT_POST(3)\fP to 1.
 
 If \fICURLOPT_POSTFIELDS(3)\fP is explicitly set to NULL then libcurl will get
 the POST data from the read callback. If you want to send a zero-byte POST set
diff --git a/docs/libcurl/opts/GNURLOPT_SSLENGINE.3 
b/docs/libcurl/opts/GNURLOPT_PROXY_TLS13_CIPHERS.3
similarity index 60%
copy from docs/libcurl/opts/GNURLOPT_SSLENGINE.3
copy to docs/libcurl/opts/GNURLOPT_PROXY_TLS13_CIPHERS.3
index 18de59da3..10ff759dc 100644
--- a/docs/libcurl/opts/GNURLOPT_SSLENGINE.3
+++ b/docs/libcurl/opts/GNURLOPT_PROXY_TLS13_CIPHERS.3
@@ -5,7 +5,7 @@
 .\" *                            | (__| |_| |  _ <| |___
 .\" *                             \___|\___/|_| \_\_____|
 .\" *
-.\" * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+.\" * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
 .\" *
 .\" * This software is licensed as described in the file COPYING, which
 .\" * you should have received as part of this distribution. The terms
@@ -20,21 +20,27 @@
 .\" *
 .\" **************************************************************************
 .\"
-.TH CURLOPT_SSLENGINE 3 "17 Jun 2014" "libcurl 7.37.0" "curl_easy_setopt 
options"
+.TH CURLOPT_PROXY_TLS13_CIPHERS 3 "25 May 2018" "libcurl 7.61.0" 
"curl_easy_setopt options"
 .SH NAME
-CURLOPT_SSLENGINE \- set SSL engine identifier
+CURLOPT_PROXY_TLS13_CIPHERS \- ciphers suites for proxy TLS 1.3
 .SH SYNOPSIS
 #include <gnurl/curl.h>
 
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSLENGINE, char *id);
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_TLS13_CIPHERS, char 
*list);
 .SH DESCRIPTION
-Pass a pointer to a zero terminated string as parameter. It will be used as
-the identifier for the crypto engine you want to use for your private key.
+Pass a char *, pointing to a zero terminated string holding the list of cipher
+suites to use for the TLS 1.3 connection to a proxy. The list must be
+syntactically correct, it consists of one or more cipher suite strings
+separated by colons.
+
+You'll find more details about cipher lists on this URL:
+
+ https://curl.haxx.se/docs/ssl-ciphers.html
 
 The application does not have to keep the string around after setting this
 option.
 .SH DEFAULT
-NULL
+NULL, use internal default
 .SH PROTOCOLS
 All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.
 .SH EXAMPLE
@@ -42,25 +48,16 @@ All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS 
etc.
 CURL *curl = curl_easy_init();
 if(curl) {
   curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/";);
-  curl_easy_setopt(curl, CURLOPT_SSLENGINE, "dynamic");
+  curl_easy_setopt(curl, CURLOPT_PROXY_TLS13_CIPHERS,
+                   "TLS13-CHACHA20-POLY1305-SHA256");
   ret = curl_easy_perform(curl);
   curl_easy_cleanup(curl);
 }
 .fi
 .SH AVAILABILITY
-Only if the SSL backend is OpenSSL built with engine support.
+Added in 7.61.0.
+Available when built with OpenSSL >= 1.1.1.
 .SH RETURN VALUE
-CURLE_OK - Engine found.
-
-CURLE_SSL_ENGINE_NOTFOUND - Engine not found, or OpenSSL was not built with
-engine support.
-
-CURLE_SSL_ENGINE_INITFAILED - Engine found but initialization failed.
-
-CURLE_NOT_BUILT_IN - Option not built in, OpenSSL is not the SSL backend.
-
-CURLE_UNKNOWN_OPTION - Option not recognized.
-
-CURLE_OUT_OF_MEMORY - Insufficient heap space.
+Returns CURLE_OK if supported, CURLE_NOT_BUILT_IN otherwise.
 .SH "SEE ALSO"
-.BR CURLOPT_SSLENGINE_DEFAULT "(3), " CURLOPT_SSLKEY "(3), "
+.BR CURLOPT_SSLVERSION "(3), " CURLOPT_TLS13_CIPHERS "(3), "
diff --git a/docs/libcurl/opts/GNURLOPT_RESOLVE.3 
b/docs/libcurl/opts/GNURLOPT_RESOLVE.3
index b6144a78a..fff2ea033 100644
--- a/docs/libcurl/opts/GNURLOPT_RESOLVE.3
+++ b/docs/libcurl/opts/GNURLOPT_RESOLVE.3
@@ -50,6 +50,11 @@ HOST+PORT will instead use your provided ADDRESS. Addresses 
set with
 \fICURLOPT_RESOLVE(3)\fP will not time-out from the DNS cache like ordinary
 entries.
 
+If the DNS cache already have an entry for the given host+port pair, then
+this entry will be removed and a new entry will be created. This is because
+old entry may have have different addresses or be ordinary entries with
+time-outs.
+
 The provided ADDRESS set by this option will be used even if
 \fICURLOPT_IPRESOLVE(3)\fP is set to make libcurl use another IP version.
 
diff --git a/docs/libcurl/opts/GNURLOPT_SSLVERSION.3 
b/docs/libcurl/opts/GNURLOPT_SSLVERSION.3
index b2b112083..81df49fdd 100644
--- a/docs/libcurl/opts/GNURLOPT_SSLVERSION.3
+++ b/docs/libcurl/opts/GNURLOPT_SSLVERSION.3
@@ -5,7 +5,7 @@
 .\" *                            | (__| |_| |  _ <| |___
 .\" *                             \___|\___/|_| \_\_____|
 .\" *
-.\" * Copyright (C) 1998 - 2015, Daniel Stenberg, <address@hidden>, et al.
+.\" * Copyright (C) 1998 - 2015, 2018, Daniel Stenberg, <address@hidden>, et 
al.
 .\" *
 .\" * This software is licensed as described in the file COPYING, which
 .\" * you should have received as part of this distribution. The terms
@@ -28,49 +28,55 @@ CURLOPT_SSLVERSION \- set preferred TLS/SSL version
 
 CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSLVERSION, long version);
 .SH DESCRIPTION
-Pass a long as parameter to control which version of SSL/TLS to attempt to
+Pass a long as parameter to control which version range of SSL/TLS versions to
 use.
 
+The SSL and TLS versions have typically developed from the most insecure
+version to be more and more secure in this order through history: SSL v2,
+SSLv3, TLS v1.0, TSL v1.1, TSL v1.2 and the most recent TLS v1.3.
+
 Use one of the available defines for this purpose. The available options are:
 .RS
 .IP CURL_SSLVERSION_DEFAULT
-The default action. This will attempt to figure out the remote SSL protocol
-version.
+The default acceptable version range. The mimimum acceptable version is by
+default TLS 1.0 since 7.39.0 (unless the TLS library has a stricter rule).
 .IP CURL_SSLVERSION_TLSv1
-TLSv1.x
+TLS v1.0 or later
 .IP CURL_SSLVERSION_SSLv2
-SSLv2
+SSL v2 (but not SSLv3)
 .IP CURL_SSLVERSION_SSLv3
-SSLv3
+SSL v3 (but not SSLv2)
 .IP CURL_SSLVERSION_TLSv1_0
-TLSv1.0 (Added in 7.34.0)
+TLS v1.0 or later (Added in 7.34.0)
 .IP CURL_SSLVERSION_TLSv1_1
-TLSv1.1 (Added in 7.34.0)
+TLS v1.1 or later (Added in 7.34.0)
 .IP CURL_SSLVERSION_TLSv1_2
-TLSv1.2 (Added in 7.34.0)
+TLS v1.2 or later (Added in 7.34.0)
 .IP CURL_SSLVERSION_TLSv1_3
-TLSv1.3 (Added in 7.52.0)
+TLS v1.3 or later (Added in 7.52.0)
 .RE
+
 The maximum TLS version can be set by using \fIone\fP of the
 CURL_SSLVERSION_MAX_ macros below. It is also possible to OR \fIone\fP of the
 CURL_SSLVERSION_ macros with \fIone\fP of the CURL_SSLVERSION_MAX_ macros.
 The MAX macros are not supported for SSL backends axTLS or wolfSSL.
 .RS
 .IP CURL_SSLVERSION_MAX_DEFAULT
-The flag defines the maximum supported TLS version as TLSv1.2, or the default
-value from the SSL library.
-(Added in 7.54.0)
+The flag defines the maximum supported TLS version by libcurl, or the default
+value from the SSL library is used. libcurl will use a sensible default
+maximum, which was TLS 1.2 up to before 7.61.0 and is TLS 1.3 since then -
+assuming the TLS library support it. (Added in 7.54.0)
 .IP CURL_SSLVERSION_MAX_TLSv1_0
-The flag defines maximum supported TLS version as TLSv1.0.
+The flag defines maximum supported TLS version as TLS v1.0.
 (Added in 7.54.0)
 .IP CURL_SSLVERSION_MAX_TLSv1_1
-The flag defines maximum supported TLS version as TLSv1.1.
+The flag defines maximum supported TLS version as TLS v1.1.
 (Added in 7.54.0)
 .IP CURL_SSLVERSION_MAX_TLSv1_2
-The flag defines maximum supported TLS version as TLSv1.2.
+The flag defines maximum supported TLS version as TLS v1.2.
 (Added in 7.54.0)
 .IP CURL_SSLVERSION_MAX_TLSv1_3
-The flag defines maximum supported TLS version as TLSv1.3.
+The flag defines maximum supported TLS version as TLS v1.3.
 (Added in 7.54.0)
 .RE
 .SH DEFAULT
diff --git a/docs/libcurl/opts/GNURLOPT_SSL_VERIFYPEER.3 
b/docs/libcurl/opts/GNURLOPT_SSL_VERIFYPEER.3
index b4d7658c7..65b8ea988 100644
--- a/docs/libcurl/opts/GNURLOPT_SSL_VERIFYPEER.3
+++ b/docs/libcurl/opts/GNURLOPT_SSL_VERIFYPEER.3
@@ -5,7 +5,7 @@
 .\" *                            | (__| |_| |  _ <| |___
 .\" *                             \___|\___/|_| \_\_____|
 .\" *
-.\" * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+.\" * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
 .\" *
 .\" * This software is licensed as described in the file COPYING, which
 .\" * you should have received as part of this distribution. The terms
@@ -57,6 +57,15 @@ man-in-the-middle the communication without you knowing it. 
Disabling
 verification makes the communication insecure. Just having encryption on a
 transfer is not enough as you cannot be sure that you are communicating with
 the correct end-point.
+
+NOTE: even when this option is disabled, depending on the used TLS backend,
+curl may still load the certificate file specified in
+\fICURLOPT_CAINFO(3)\fP. curl default settings in some distributions might use
+quite a large file as a default setting for \fICURLOPT_CAINFO(3)\fP, so
+loading the file can be quite expensive, especially when dealing with many
+connections. Thus, in some situations, you might want to disable verification
+fully to save resources by setting \fICURLOPT_CAINFO(3)\fP to NULL - but
+please also consider the warning above!
 .SH DEFAULT
 By default, curl assumes a value of 1.
 .SH PROTOCOLS
@@ -81,3 +90,4 @@ Returns CURLE_OK if the option is supported, and 
CURLE_UNKNOWN_OPTION if not.
 .BR CURLOPT_SSL_VERIFYHOST "(3), "
 .BR CURLOPT_PROXY_SSL_VERIFYPEER "(3), "
 .BR CURLOPT_PROXY_SSL_VERIFYHOST "(3), "
+.BR CURLOPT_CAINFO "(3), "
diff --git a/docs/libcurl/opts/GNURLOPT_EGDSOCKET.3 
b/docs/libcurl/opts/GNURLOPT_TLS13_CIPHERS.3
similarity index 61%
copy from docs/libcurl/opts/GNURLOPT_EGDSOCKET.3
copy to docs/libcurl/opts/GNURLOPT_TLS13_CIPHERS.3
index 2068ea5b1..fea7e9df9 100644
--- a/docs/libcurl/opts/GNURLOPT_EGDSOCKET.3
+++ b/docs/libcurl/opts/GNURLOPT_TLS13_CIPHERS.3
@@ -5,7 +5,7 @@
 .\" *                            | (__| |_| |  _ <| |___
 .\" *                             \___|\___/|_| \_\_____|
 .\" *
-.\" * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+.\" * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
 .\" *
 .\" * This software is licensed as described in the file COPYING, which
 .\" * you should have received as part of this distribution. The terms
@@ -20,21 +20,26 @@
 .\" *
 .\" **************************************************************************
 .\"
-.TH CURLOPT_EGDSOCKET 3 "17 Jun 2014" "libcurl 7.37.0" "curl_easy_setopt 
options"
+.TH CURLOPT_TLS13_CIPHERS 3 "25 May 2018" "libcurl 7.61.0" "curl_easy_setopt 
options"
 .SH NAME
-CURLOPT_EGDSOCKET \- set EGD socket path
+CURLOPT_TLS13_CIPHERS \- specify ciphers suites to use for TLS 1.3
 .SH SYNOPSIS
 #include <gnurl/curl.h>
 
-CURLcode curl_easy_setopt(CURL *handle, CURLOPT_EGDSOCKET, char *path);
+CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TLS13_CIPHERS, char *list);
 .SH DESCRIPTION
-Pass a char * to the zero terminated path name to the Entropy Gathering Daemon
-socket. It will be used to seed the random engine for SSL.
+Pass a char *, pointing to a zero terminated string holding the list of cipher
+suites to use for the TLS 1.3 connection. The list must be syntactically
+correct, it consists of one or more cipher suite strings separated by colons.
+
+You'll find more details about cipher lists on this URL:
+
+ https://curl.haxx.se/docs/ssl-ciphers.html
 
 The application does not have to keep the string around after setting this
 option.
 .SH DEFAULT
-NULL
+NULL, use internal default
 .SH PROTOCOLS
 All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.
 .SH EXAMPLE
@@ -42,15 +47,16 @@ All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS 
etc.
 CURL *curl = curl_easy_init();
 if(curl) {
   curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/";);
-  curl_easy_setopt(curl, CURLOPT_EGDSOCKET, "/var/egd.socket");
+  curl_easy_setopt(curl, CURLOPT_TLS13_CIPHERS,
+                   "TLS13-CHACHA20-POLY1305-SHA256");
   ret = curl_easy_perform(curl);
   curl_easy_cleanup(curl);
 }
 .fi
 .SH AVAILABILITY
-If built TLS enabled. Only the OpenSSL and GnuTLS backends will use this.
+Added in 7.61.0.
+Available when built with OpenSSL >= 1.1.1.
 .SH RETURN VALUE
-Returns CURLE_OK if TLS is supported, CURLE_UNKNOWN_OPTION if not, or
-CURLE_OUT_OF_MEMORY if there was insufficient heap space.
+Returns CURLE_OK if supported, CURLE_NOT_BUILT_IN otherwise.
 .SH "SEE ALSO"
-.BR CURLOPT_RANDOM_FILE "(3), "
+.BR CURLOPT_SSLVERSION "(3), " CURLOPT_PROXY_TLS13_CIPHERS "(3), "
diff --git a/docs/libcurl/opts/GNURLOPT_WILDCARDMATCH.3 
b/docs/libcurl/opts/GNURLOPT_WILDCARDMATCH.3
index 6dfe91215..8964602bf 100644
--- a/docs/libcurl/opts/GNURLOPT_WILDCARDMATCH.3
+++ b/docs/libcurl/opts/GNURLOPT_WILDCARDMATCH.3
@@ -5,7 +5,7 @@
 .\" *                            | (__| |_| |  _ <| |___
 .\" *                             \___|\___/|_| \_\_____|
 .\" *
-.\" * Copyright (C) 1998 - 2014, Daniel Stenberg, <address@hidden>, et al.
+.\" * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
 .\" *
 .\" * This software is licensed as described in the file COPYING, which
 .\" * you should have received as part of this distribution. The terms
@@ -41,7 +41,7 @@ A brief introduction of its syntax follows:
 .RS
 .IP "* - ASTERISK"
 \&ftp://example.com/some/path/\fB*.txt\fP (for all txt's from the root
-directory)
+directory). Only two asterisks are allowed within the same pattern string.
 .RE
 .RS
 .IP "? - QUESTION MARK"
diff --git a/docs/libcurl/opts/GNURLOPT_XOAUTH2_BEARER.3 
b/docs/libcurl/opts/GNURLOPT_XOAUTH2_BEARER.3
index f7377a372..3f13e4e47 100644
--- a/docs/libcurl/opts/GNURLOPT_XOAUTH2_BEARER.3
+++ b/docs/libcurl/opts/GNURLOPT_XOAUTH2_BEARER.3
@@ -29,11 +29,11 @@ CURLOPT_XOAUTH2_BEARER \- specify OAuth 2.0 access token
 CURLcode curl_easy_setopt(CURL *handle, CURLOPT_XOAUTH2_BEARER, char *token);
 .SH DESCRIPTION
 Pass a char * as parameter, which should point to the zero terminated OAuth
-2.0 Bearer Access Token for use with IMAP, POP3 and SMTP servers that support
-the OAuth 2.0 Authorization Framework.
+2.0 Bearer Access Token for use with HTTP, IMAP, POP3 and SMTP servers
+that support the OAuth 2.0 Authorization Framework.
 
-Note: The user name used to generate the Bearer Token should be supplied via
-the \fICURLOPT_USERNAME(3)\fP option.
+Note: For IMAP, POP3 and SMTP, the user name used to generate the Bearer Token
+should be supplied via the \fICURLOPT_USERNAME(3)\fP option.
 
 The application does not have to keep the string around after setting this
 option.
diff --git a/docs/libcurl/opts/Makefile.inc b/docs/libcurl/opts/Makefile.inc
index 620f32bd8..67ae66701 100644
--- a/docs/libcurl/opts/Makefile.inc
+++ b/docs/libcurl/opts/Makefile.inc
@@ -3,9 +3,11 @@
 man_MANS =                                      \
   GNURLINFO_ACTIVESOCKET.3                       \
   GNURLINFO_APPCONNECT_TIME.3                    \
+  GNURLINFO_APPCONNECT_TIME_T.3                  \
   GNURLINFO_CERTINFO.3                           \
   GNURLINFO_CONDITION_UNMET.3                    \
   GNURLINFO_CONNECT_TIME.3                       \
+  GNURLINFO_CONNECT_TIME_T.3                     \
   GNURLINFO_CONTENT_LENGTH_DOWNLOAD.3            \
   GNURLINFO_CONTENT_LENGTH_DOWNLOAD_T.3          \
   GNURLINFO_CONTENT_LENGTH_UPLOAD.3              \
@@ -24,9 +26,11 @@ man_MANS =                                      \
   GNURLINFO_LOCAL_IP.3                           \
   GNURLINFO_LOCAL_PORT.3                         \
   GNURLINFO_NAMELOOKUP_TIME.3                    \
+  GNURLINFO_NAMELOOKUP_TIME_T.3                  \
   GNURLINFO_NUM_CONNECTS.3                       \
   GNURLINFO_OS_ERRNO.3                           \
   GNURLINFO_PRETRANSFER_TIME.3                   \
+  GNURLINFO_PRETRANSFER_TIME_T.3                 \
   GNURLINFO_PRIMARY_IP.3                         \
   GNURLINFO_PRIMARY_PORT.3                       \
   GNURLINFO_PRIVATE.3                            \
@@ -35,6 +39,7 @@ man_MANS =                                      \
   GNURLINFO_PROXY_SSL_VERIFYRESULT.3             \
   GNURLINFO_REDIRECT_COUNT.3                     \
   GNURLINFO_REDIRECT_TIME.3                      \
+  GNURLINFO_REDIRECT_TIME_T.3                    \
   GNURLINFO_REDIRECT_URL.3                       \
   GNURLINFO_REQUEST_SIZE.3                       \
   GNURLINFO_RESPONSE_CODE.3                      \
@@ -54,9 +59,11 @@ man_MANS =                                      \
   GNURLINFO_SSL_ENGINES.3                        \
   GNURLINFO_SSL_VERIFYRESULT.3                   \
   GNURLINFO_STARTTRANSFER_TIME.3                 \
+  GNURLINFO_STARTTRANSFER_TIME_T.3               \
   GNURLINFO_TLS_SESSION.3                        \
   GNURLINFO_TLS_SSL_PTR.3                        \
   GNURLINFO_TOTAL_TIME.3                         \
+  GNURLINFO_TOTAL_TIME_T.3                       \
   GNURLMOPT_CHUNK_LENGTH_PENALTY_SIZE.3          \
   GNURLMOPT_CONTENT_LENGTH_PENALTY_SIZE.3        \
   GNURLMOPT_MAXCONNECTS.3                        \
@@ -107,6 +114,7 @@ man_MANS =                                      \
   GNURLOPT_DEBUGFUNCTION.3                       \
   GNURLOPT_DEFAULT_PROTOCOL.3                    \
   GNURLOPT_DIRLISTONLY.3                         \
+  GNURLOPT_DISALLOW_USERNAME_IN_URL.3            \
   GNURLOPT_DNS_CACHE_TIMEOUT.3                   \
   GNURLOPT_DNS_INTERFACE.3                       \
   GNURLOPT_DNS_LOCAL_IP4.3                       \
@@ -230,6 +238,7 @@ man_MANS =                                      \
   GNURLOPT_PROXY_SSL_OPTIONS.3                   \
   GNURLOPT_PROXY_SSL_VERIFYHOST.3                \
   GNURLOPT_PROXY_SSL_VERIFYPEER.3                \
+  GNURLOPT_PROXY_TLS13_CIPHERS.3                 \
   GNURLOPT_PROXY_TLSAUTH_PASSWORD.3              \
   GNURLOPT_PROXY_TLSAUTH_TYPE.3                  \
   GNURLOPT_PROXY_TLSAUTH_USERNAME.3              \
@@ -308,6 +317,7 @@ man_MANS =                                      \
   GNURLOPT_TIMEOUT_MS.3                          \
   GNURLOPT_TIMEVALUE.3                           \
   GNURLOPT_TIMEVALUE_LARGE.3                     \
+  GNURLOPT_TLS13_CIPHERS.3                       \
   GNURLOPT_TLSAUTH_PASSWORD.3                    \
   GNURLOPT_TLSAUTH_TYPE.3                        \
   GNURLOPT_TLSAUTH_USERNAME.3                    \
diff --git a/docs/libcurl/symbols-in-versions b/docs/libcurl/symbols-in-versions
index 52e8407dd..7448b4f43 100644
--- a/docs/libcurl/symbols-in-versions
+++ b/docs/libcurl/symbols-in-versions
@@ -15,6 +15,7 @@
 CURLAUTH_ANY                    7.10.6
 CURLAUTH_ANYSAFE                7.10.6
 CURLAUTH_BASIC                  7.10.6
+CURLAUTH_BEARER                 7.61.0
 CURLAUTH_DIGEST                 7.10.6
 CURLAUTH_DIGEST_IE              7.19.3
 CURLAUTH_GSSAPI                 7.55.0
@@ -100,8 +101,8 @@ CURLE_PEER_FAILED_VERIFICATION  7.17.1
 CURLE_QUOTE_ERROR               7.17.0
 CURLE_RANGE_ERROR               7.17.0
 CURLE_READ_ERROR                7.1
-CURLE_RECV_ERROR                7.10
 CURLE_RECURSIVE_API_CALL        7.59.0
+CURLE_RECV_ERROR                7.10
 CURLE_REMOTE_ACCESS_DENIED      7.17.0
 CURLE_REMOTE_DISK_FULL          7.17.0
 CURLE_REMOTE_FILE_EXISTS        7.17.0
@@ -206,9 +207,11 @@ CURLHEADER_SEPARATE             7.37.0
 CURLHEADER_UNIFIED              7.37.0
 CURLINFO_ACTIVESOCKET           7.45.0
 CURLINFO_APPCONNECT_TIME        7.19.0
+CURLINFO_APPCONNECT_TIME_T      7.61.0
 CURLINFO_CERTINFO               7.19.1
 CURLINFO_CONDITION_UNMET        7.19.4
 CURLINFO_CONNECT_TIME           7.4.1
+CURLINFO_CONNECT_TIME_T         7.61.0
 CURLINFO_CONTENT_LENGTH_DOWNLOAD 7.6.1
 CURLINFO_CONTENT_LENGTH_DOWNLOAD_T 7.55.0
 CURLINFO_CONTENT_LENGTH_UPLOAD  7.6.1
@@ -237,11 +240,13 @@ CURLINFO_LOCAL_PORT             7.21.0
 CURLINFO_LONG                   7.4.1
 CURLINFO_MASK                   7.4.1
 CURLINFO_NAMELOOKUP_TIME        7.4.1
+CURLINFO_NAMELOOKUP_TIME_T      7.61.0
 CURLINFO_NONE                   7.4.1
 CURLINFO_NUM_CONNECTS           7.12.3
 CURLINFO_OFF_T                  7.55.0
 CURLINFO_OS_ERRNO               7.12.2
 CURLINFO_PRETRANSFER_TIME       7.4.1
+CURLINFO_PRETRANSFER_TIME_T     7.61.0
 CURLINFO_PRIMARY_IP             7.19.0
 CURLINFO_PRIMARY_PORT           7.21.0
 CURLINFO_PRIVATE                7.10.3
@@ -251,6 +256,7 @@ CURLINFO_PROXY_SSL_VERIFYRESULT 7.52.0
 CURLINFO_PTR                    7.54.1
 CURLINFO_REDIRECT_COUNT         7.9.7
 CURLINFO_REDIRECT_TIME          7.9.7
+CURLINFO_REDIRECT_TIME_T        7.61.0
 CURLINFO_REDIRECT_URL           7.18.2
 CURLINFO_REQUEST_SIZE           7.4.1
 CURLINFO_RESPONSE_CODE          7.10.8
@@ -274,11 +280,13 @@ CURLINFO_SSL_DATA_OUT           7.12.1
 CURLINFO_SSL_ENGINES            7.12.3
 CURLINFO_SSL_VERIFYRESULT       7.5
 CURLINFO_STARTTRANSFER_TIME     7.9.2
+CURLINFO_STARTTRANSFER_TIME_T   7.61.0
 CURLINFO_STRING                 7.4.1
 CURLINFO_TEXT                   7.9.6
 CURLINFO_TLS_SESSION            7.34.0        7.48.0
 CURLINFO_TLS_SSL_PTR            7.48.0
 CURLINFO_TOTAL_TIME             7.4.1
+CURLINFO_TOTAL_TIME_T           7.61.0
 CURLINFO_TYPEMASK               7.4.1
 CURLIOCMD_NOP                   7.12.3
 CURLIOCMD_RESTARTREAD           7.12.3
@@ -368,6 +376,7 @@ CURLOPT_DEBUGDATA               7.9.6
 CURLOPT_DEBUGFUNCTION           7.9.6
 CURLOPT_DEFAULT_PROTOCOL        7.45.0
 CURLOPT_DIRLISTONLY             7.17.0
+CURLOPT_DISALLOW_USERNAME_IN_URL 7.61.0
 CURLOPT_DNS_CACHE_TIMEOUT       7.9.3
 CURLOPT_DNS_INTERFACE           7.33.0
 CURLOPT_DNS_LOCAL_IP4           7.33.0
@@ -506,6 +515,7 @@ CURLOPT_PROXY_SSL_CIPHER_LIST   7.52.0
 CURLOPT_PROXY_SSL_OPTIONS       7.52.0
 CURLOPT_PROXY_SSL_VERIFYHOST    7.52.0
 CURLOPT_PROXY_SSL_VERIFYPEER    7.52.0
+CURLOPT_PROXY_TLS13_CIPHERS     7.61.0
 CURLOPT_PROXY_TLSAUTH_PASSWORD  7.52.0
 CURLOPT_PROXY_TLSAUTH_TYPE      7.52.0
 CURLOPT_PROXY_TLSAUTH_USERNAME  7.52.0
@@ -520,6 +530,8 @@ CURLOPT_REDIR_PROTOCOLS         7.19.4
 CURLOPT_REFERER                 7.1
 CURLOPT_REQUEST_TARGET          7.55.0
 CURLOPT_RESOLVE                 7.21.3
+CURLOPT_RESOLVER_START_DATA     7.59.0
+CURLOPT_RESOLVER_START_FUNCTION 7.59.0
 CURLOPT_RESUME_FROM             7.1
 CURLOPT_RESUME_FROM_LARGE       7.11.0
 CURLOPT_RTSPHEADER              7.20.0
@@ -594,13 +606,12 @@ CURLOPT_TIMEOUT                 7.1
 CURLOPT_TIMEOUT_MS              7.16.2
 CURLOPT_TIMEVALUE               7.1
 CURLOPT_TIMEVALUE_LARGE         7.59.0
+CURLOPT_TLS13_CIPHERS           7.61.0
 CURLOPT_TLSAUTH_PASSWORD        7.21.4
 CURLOPT_TLSAUTH_TYPE            7.21.4
 CURLOPT_TLSAUTH_USERNAME        7.21.4
 CURLOPT_TRANSFERTEXT            7.1.1
 CURLOPT_TRANSFER_ENCODING       7.21.6
-CURLOPT_RESOLVER_START_FUNCTION 7.59.0
-CURLOPT_RESOLVER_START_DATA     7.59.0
 CURLOPT_UNIX_SOCKET_PATH        7.40.0
 CURLOPT_UNRESTRICTED_AUTH       7.10.4
 CURLOPT_UPLOAD                  7.1
@@ -772,6 +783,7 @@ CURL_LOCK_DATA_CONNECT          7.10.3
 CURL_LOCK_DATA_COOKIE           7.10.3
 CURL_LOCK_DATA_DNS              7.10.3
 CURL_LOCK_DATA_NONE             7.10.3
+CURL_LOCK_DATA_PSL              7.61.0
 CURL_LOCK_DATA_SHARE            7.10.4
 CURL_LOCK_DATA_SSL_SESSION      7.10.3
 CURL_LOCK_TYPE_CONNECT          7.10          -           7.10.2
diff --git a/guix.scm b/guix.scm
index b0fa27632..639963be5 100644
--- a/guix.scm
+++ b/guix.scm
@@ -41,7 +41,7 @@
   (package
     (inherit gnurl)
     (name "gnurl-git")
-    (version (string-append "7.60.0-" "dev"))
+    (version (string-append "7.61.0-" "dev"))
     (source
      (local-file %source-dir
                  #:recursive? #t))
diff --git a/include/README b/include/README
index 12516ebe6..f4cfd9a68 100644
--- a/include/README
+++ b/include/README
@@ -14,20 +14,5 @@ of environment. You must include files from here using...
 ... style and point the compiler's include path to the directory holding the
 curl subdirectory. It makes it more likely to survive future modifications.
 
-NOTE FOR LIBCURL HACKERS
-
-* If you check out from git on a non-configure platform, you must run the
-  appropriate buildconf* script to set up files before being able of compiling
-  the library.
-
-* We cannot assume anything else but very basic compiler features being
-  present. While libcurl requires an ANSI C compiler to build, some of the
-  earlier ANSI compilers clearly can't deal with some preprocessor operators.
-
-* Newlines must remain unix-style for older compilers' sake.
-
-* Comments must be written in the old-style /* unnested C-fashion */
-
-To figure out how to do good and portable checks for features, operating
-systems or specific hardwarare, a very good resource is Bjorn Reese's
-collection at https://sourceforge.net/p/predef/wiki/
+The public curl include files can be shared freely between different platforms
+and different architectures.
diff --git a/include/gnurl/curl.h b/include/gnurl/curl.h
index 3fd4ca87d..067b34ded 100644
--- a/include/gnurl/curl.h
+++ b/include/gnurl/curl.h
@@ -691,6 +691,7 @@ typedef enum {
  * CURLAUTH_NTLM         - HTTP NTLM authentication
  * CURLAUTH_DIGEST_IE    - HTTP Digest authentication with IE flavour
  * CURLAUTH_NTLM_WB      - HTTP NTLM authentication delegated to winbind helper
+ * CURLAUTH_BEARER       - HTTP Bearer token authentication
  * CURLAUTH_ONLY         - Use together with a single other type to force no
  *                         authentication or just that single type
  * CURLAUTH_ANY          - All fine types set
@@ -708,6 +709,7 @@ typedef enum {
 #define CURLAUTH_NTLM         (((unsigned long)1)<<3)
 #define CURLAUTH_DIGEST_IE    (((unsigned long)1)<<4)
 #define CURLAUTH_NTLM_WB      (((unsigned long)1)<<5)
+#define CURLAUTH_BEARER       (((unsigned long)1)<<6)
 #define CURLAUTH_ONLY         (((unsigned long)1)<<31)
 #define CURLAUTH_ANY          (~CURLAUTH_DIGEST_IE)
 #define CURLAUTH_ANYSAFE      (~(CURLAUTH_BASIC|CURLAUTH_DIGEST_IE))
@@ -1847,6 +1849,13 @@ typedef enum {
   /* shuffle addresses before use when DNS returns multiple */
   CINIT(DNS_SHUFFLE_ADDRESSES, LONG, 275),
 
+  /* Specify which TLS 1.3 ciphers suites to use */
+  CINIT(TLS13_CIPHERS, STRINGPOINT, 276),
+  CINIT(PROXY_TLS13_CIPHERS, STRINGPOINT, 277),
+
+  /* Disallow specifying username/login in URL. */
+  CINIT(DISALLOW_USERNAME_IN_URL, LONG, 278),
+
   CURLOPT_LASTENTRY /* the last unused */
 } CURLoption;
 
@@ -2527,7 +2536,17 @@ typedef enum {
   CURLINFO_SCHEME           = CURLINFO_STRING + 49,
   /* Fill in new entries below here! */
 
-  CURLINFO_LASTONE          = 49
+  /* Preferably these would be defined conditionally based on the
+     sizeof curl_off_t being 64-bits */
+  CURLINFO_TOTAL_TIME_T     = CURLINFO_OFF_T + 50,
+  CURLINFO_NAMELOOKUP_TIME_T = CURLINFO_OFF_T + 51,
+  CURLINFO_CONNECT_TIME_T   = CURLINFO_OFF_T + 52,
+  CURLINFO_PRETRANSFER_TIME_T = CURLINFO_OFF_T + 53,
+  CURLINFO_STARTTRANSFER_TIME_T = CURLINFO_OFF_T + 54,
+  CURLINFO_REDIRECT_TIME_T  = CURLINFO_OFF_T + 55,
+  CURLINFO_APPCONNECT_TIME_T = CURLINFO_OFF_T + 56,
+
+  CURLINFO_LASTONE          = 56
 } CURLINFO;
 
 /* CURLINFO_RESPONSE_CODE is the new name for the option previously known as
@@ -2570,6 +2589,7 @@ typedef enum {
   CURL_LOCK_DATA_DNS,
   CURL_LOCK_DATA_SSL_SESSION,
   CURL_LOCK_DATA_CONNECT,
+  CURL_LOCK_DATA_PSL,
   CURL_LOCK_DATA_LAST
 } curl_lock_data;
 
diff --git a/include/gnurl/curlver.h b/include/gnurl/curlver.h
index 26f2371a7..d28c1fe9c 100644
--- a/include/gnurl/curlver.h
+++ b/include/gnurl/curlver.h
@@ -30,12 +30,12 @@
 
 /* This is the version number of the libcurl package from which this header
    file origins: */
-#define LIBCURL_VERSION "7.60.0-DEV"
+#define LIBCURL_VERSION "7.61.0-DEV"
 
 /* The numeric version number is also available "in parts" by using these
    defines: */
 #define LIBCURL_VERSION_MAJOR 7
-#define LIBCURL_VERSION_MINOR 60
+#define LIBCURL_VERSION_MINOR 61
 #define LIBCURL_VERSION_PATCH 0
 
 /* This is the numeric version of the libcurl version number, meant for easier
@@ -57,7 +57,7 @@
    CURL_VERSION_BITS() macro since curl's own configure script greps for it
    and needs it to contain the full number.
 */
-#define LIBCURL_VERSION_NUM 0x073C00
+#define LIBCURL_VERSION_NUM 0x073D00
 
 /*
  * This is the date and time when the full source package was created. The
diff --git a/include/gnurl/system.h b/include/gnurl/system.h
index eac4cfeb6..a54fd584f 100644
--- a/include/gnurl/system.h
+++ b/include/gnurl/system.h
@@ -320,6 +320,24 @@
 #  define CURL_PULL_SYS_TYPES_H      1
 #  define CURL_PULL_SYS_SOCKET_H     1
 
+#elif defined(__xlc__) /* IBM xlc compiler */
+#  if !defined(_LP64)
+#    define CURL_TYPEOF_CURL_OFF_T     long long
+#    define CURL_FORMAT_CURL_OFF_T     "lld"
+#    define CURL_FORMAT_CURL_OFF_TU    "llu"
+#    define CURL_SUFFIX_CURL_OFF_T     LL
+#    define CURL_SUFFIX_CURL_OFF_TU    ULL
+#  else
+#    define CURL_TYPEOF_CURL_OFF_T     long
+#    define CURL_FORMAT_CURL_OFF_T     "ld"
+#    define CURL_FORMAT_CURL_OFF_TU    "lu"
+#    define CURL_SUFFIX_CURL_OFF_T     L
+#    define CURL_SUFFIX_CURL_OFF_TU    UL
+#  endif
+#  define CURL_TYPEOF_CURL_SOCKLEN_T socklen_t
+#  define CURL_PULL_SYS_TYPES_H      1
+#  define CURL_PULL_SYS_SOCKET_H     1
+
 /* ===================================== */
 /*    KEEP MSVC THE PENULTIMATE ENTRY    */
 /* ===================================== */
@@ -344,7 +362,7 @@
 /*    KEEP GENERIC GCC THE LAST ENTRY    */
 /* ===================================== */
 
-#elif defined(__GNUC__)
+#elif defined(__GNUC__) && !defined(_SCO_DS)
 #  if !defined(__LP64__) &&                                             \
   (defined(__ILP32__) || defined(__i386__) || defined(__hppa__) ||      \
    defined(__ppc__) || defined(__powerpc__) || defined(__arm__) ||      \
diff --git a/include/gnurl/typecheck-gcc.h b/include/gnurl/typecheck-gcc.h
index 3a0f253f6..a6f638614 100644
--- a/include/gnurl/typecheck-gcc.h
+++ b/include/gnurl/typecheck-gcc.h
@@ -428,7 +428,7 @@ _CURL_WARNING(_curl_easy_getinfo_err_curl_off_t,
  * == or whatsoever.
  */
 
-/* XXX: should evaluate to true iff expr is a pointer */
+/* XXX: should evaluate to true if expr is a pointer */
 #define _curl_is_any_ptr(expr)                                                \
   (sizeof(expr) == sizeof(void *))
 
diff --git a/lib/CMakeLists.txt b/lib/CMakeLists.txt
index 1fabdba90..6653d555f 100644
--- a/lib/CMakeLists.txt
+++ b/lib/CMakeLists.txt
@@ -98,13 +98,6 @@ if(WIN32)
   if(NOT CURL_STATICLIB)
     # Add "_imp" as a suffix before the extension to avoid conflicting with 
the statically linked "libcurl.lib"
     set_target_properties(${LIB_NAME} PROPERTIES IMPORT_SUFFIX "_imp.lib")
-
-    set_target_properties (${LIB_NAME} PROPERTIES
-       DEBUG_POSTFIX "-d"
-       # Note: no postfix for release variants, let user choose what style of 
release he wants
-       # MINSIZEREL_POSTFIX "-z"
-       # RELWITHDEBINFO_POSTFIX "-g"
-       )
   endif()
 endif()
 
diff --git a/lib/Makefile.am b/lib/Makefile.am
index d1338c992..f43dc2964 100644
--- a/lib/Makefile.am
+++ b/lib/Makefile.am
@@ -5,7 +5,7 @@
 #                            | (__| |_| |  _ <| |___
 #                             \___|\___/|_| \_\_____|
 #
-# Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+# Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
 #
 # This software is licensed as described in the file COPYING, which
 # you should have received as part of this distribution. The terms
@@ -23,7 +23,7 @@ AUTOMAKE_OPTIONS = foreign nostdinc
 
 CMAKE_DIST = CMakeLists.txt curl_config.h.cmake
 
-EXTRA_DIST = Makefile.b32 Makefile.m32 config-win32.h  \
+EXTRA_DIST = Makefile.m32 config-win32.h                               \
  config-win32ce.h config-riscos.h config-mac.h curl_config.h.in                
\
  makefile.dj config-dos.h libgnurl.plist libcurl.rc config-amigaos.h   \
  makefile.amiga Makefile.netware nwlib.c nwos.c config-win32ce.h       \
diff --git a/lib/Makefile.b32 b/lib/Makefile.b32
deleted file mode 100644
index 5b5b5fa9f..000000000
--- a/lib/Makefile.b32
+++ /dev/null
@@ -1,185 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) 2000, Jaepil Kim, <address@hidden>.
-# Copyright (C) 2001 - 2015, Daniel Stenberg, <address@hidden>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.haxx.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-#***************************************************************************
-
-############################################################
-#
-#  Makefile.b32 - Borland's C++ Compiler 5.X
-#
-#  'BCCDIR' has to be set up to point to the base directory
-#  of the compiler, i.e. SET BCCDIR = c:\Borland\BCC55
-#
-############################################################
-
-!if "$(__MAKE__)" == ""
-!error __MAKE__ not defined. Use Borlands's MAKE to process this makefile.
-!endif
-
-# Borland's $(MAKEDIR) expands to the path where make.exe is located,
-# use this feature to define BCCDIR when user has not defined BCCDIR.
-!ifndef BCCDIR
-BCCDIR = $(MAKEDIR)\..
-!endif
-
-# Edit the path below to point to the base of your Zlib sources.
-!ifndef ZLIB_PATH
-ZLIB_PATH = ..\..\zlib-1.2.8
-!endif
-
-# Edit the path below to point to the base of your OpenSSL package.
-!ifndef OPENSSL_PATH
-OPENSSL_PATH = ..\..\openssl-1.0.2a
-!endif
-
-# Set libcurl static lib, dll and import lib
-LIBCURL_LIB    = libcurl.lib
-LIBCURL_DLL    = libcurl.dll
-LIBCURL_IMPLIB = libcurl_imp.lib
-
-# Setup environment
-PP_CMD   = cpp32 -q -P-
-CC_CMD   = bcc32 -q -c
-LD       = bcc32
-RM       = del 2>NUL
-MKDIR    = md
-RMDIR    = rd /q
-LIB      = tlib
-IMPLIB   = implib
-
-CC_FLAGS = -5 -O2 -tWM -w -w-aus -w-ccc -w-dup -w-prc -w-pro -w-rch -w-sig 
-w-spa -w-inl -w-pia -w-pin -Dinline=__inline
-LIBFLAGS = /C /P32
-LDFLAGS  = -q -lq -laa -tWD
-
-SRCDIR   = .;.\vauth;.\vtls
-OBJDIR   = .\BCC_objs
-INCDIRS  = -I.;.\lib;..\include
-LINKLIB  = $(BCCDIR)\lib\cw32mt.lib $(BCCDIR)\lib\ws2_32.lib
-DEFINES  = -DNDEBUG -DWIN32 -DBUILDING_LIBCURL
-
-# By default SSPI support is enabled for BCC
-!ifndef DISABLE_SSPI
-DEFINES  = $(DEFINES) -DUSE_WINDOWS_SSPI
-!endif
-
-# By default LDAP support is disabled for BCC
-!ifndef WITH_LDAP
-DEFINES  = $(DEFINES) -DCURL_DISABLE_LDAP
-!endif
-
-# ZLIB support is enabled setting WITH_ZLIB=1
-!ifdef WITH_ZLIB
-DEFINES  = $(DEFINES) -DHAVE_LIBZ -DHAVE_ZLIB_H
-INCDIRS  = $(INCDIRS);$(ZLIB_PATH)
-LINKLIB  = $(LINKLIB) $(ZLIB_PATH)\zlib.lib
-!endif
-
-# SSL support is enabled setting WITH_SSL=1
-!ifdef WITH_SSL
-DEFINES  = $(DEFINES) -DUSE_OPENSSL
-INCDIRS  = $(INCDIRS);$(OPENSSL_PATH)\inc32;$(OPENSSL_PATH)\inc32\openssl
-LINKLIB  = $(LINKLIB) $(OPENSSL_PATH)\out32\ssleay32.lib 
$(OPENSSL_PATH)\out32\libeay32.lib
-!endif
-
-.autodepend
-
-.path.c   = $(SRCDIR)
-.path.obj = $(OBJDIR)
-.path.int = $(OBJDIR)
-
-# Makefile.inc provides the CSOURCES and HHEADERS defines
-!include Makefile.inc
-
-# Borland's command line librarian program TLIB version 4.5 is not capable
-# of building a library when any of its objects contains an hyphen in its
-# name, due to a command line parsing bug. In order to workaround this, we
-# build source files with hyphens in their name as objects with underscores
-# using explicit compilation build rules instead of implicit ones.
-
-NOHYPHEN1 = $(CSOURCES:-=_)
-NOHYPHEN2 = $(NOHYPHEN1:vauth/=)
-NOHYPHEN3 = $(NOHYPHEN2:vtls/=)
-
-OBJECTS = $(NOHYPHEN3:.c=.obj)
-PREPROCESSED = $(NOHYPHEN3:.c=.int)
-
-# Borland's command line compiler (BCC32) version 5.5.1 integrated
-# preprocessor has a bug which results in silently generating wrong
-# definitions for libcurl macros such as CURL_OFF_T_C, on the other
-# hand Borland's command line preprocessor (CPP32) version 5.5.1 does
-# not have the bug and achieves proper results. In order to avoid the
-# silent bug we first preprocess source files and later compile the
-# preprocessed result.
-
-.c.obj:
-       @-$(RM) $(@R).int
-       $(PP_CMD) $(CC_FLAGS) $(INCDIRS) $(DEFINES) -o$(@R).int $(<)
-       $(CC_CMD) $(CC_FLAGS) -o$(@) $(@R).int
-
-all:   $(OBJDIR) $(LIBCURL_LIB) $(LIBCURL_DLL)
-
-asyn_ares.obj: asyn-ares.c
-       @-$(RM) $(@R).int
-       $(PP_CMD) $(CC_FLAGS) $(INCDIRS) $(DEFINES) -o$(@R).int $(?)
-       $(CC_CMD) $(CC_FLAGS) -o$(@) $(@R).int
-
-asyn_thread.obj: asyn-thread.c
-       @-$(RM) $(@R).int
-       $(PP_CMD) $(CC_FLAGS) $(INCDIRS) $(DEFINES) -o$(@R).int $(?)
-       $(CC_CMD) $(CC_FLAGS) -o$(@) $(@R).int
-
-non_ascii.obj: non-ascii.c
-       @-$(RM) $(@R).int
-       $(PP_CMD) $(CC_FLAGS) $(INCDIRS) $(DEFINES) -o$(@R).int $(?)
-       $(CC_CMD) $(CC_FLAGS) -o$(@) $(@R).int
-
-clean:
-       cd $(OBJDIR)
-       @-$(RM) $(OBJECTS)
-       @-$(RM) $(PREPROCESSED)
-       cd ..
-       @-$(RMDIR) $(OBJDIR)
-       @-$(RM) $(LIBCURL_LIB)
-       @-$(RM) $(LIBCURL_IMPLIB)
-       @-$(RM) libcurl.tds
-
-$(OBJDIR):
-       @-$(RMDIR) $(OBJDIR)
-       @-$(MKDIR) $(OBJDIR)
-
-$(LIBCURL_LIB): $(OBJECTS)
-       @-$(RM) $(LIBCURL_LIB)
-       $(LIB) $(LIBFLAGS) $@ @&&!
-+$(**: = &^
-+)
-!
-
-$(LIBCURL_DLL) $(LIBCURL_IMPLIB): $(OBJECTS) $(LINKLIB)
-       @-$(RM) $(LIBCURL_DLL)
-       @-$(RM) $(LIBCURL_IMPLIB)
-       $(LD) $(LDFLAGS) -e$(LIBCURL_DLL) @&&!
-$(**: = ^
-)
-!
-       $(IMPLIB) $(LIBCURL_IMPLIB) $(LIBCURL_DLL)
-
-
-# End of Makefile.b32
diff --git a/lib/Makefile.inc b/lib/Makefile.inc
index 61c23411d..76ca6d041 100644
--- a/lib/Makefile.inc
+++ b/lib/Makefile.inc
@@ -54,7 +54,7 @@ LIB_CFILES = file.c timeval.c base64.c hostip.c progress.c 
formdata.c   \
   http_ntlm.c curl_ntlm_wb.c curl_ntlm_core.c curl_sasl.c rand.c        \
   curl_multibyte.c hostcheck.c conncache.c pipeline.c dotdot.c          \
   x509asn1.c http2.c smb.c curl_endian.c curl_des.c system_win32.c      \
-  mime.c sha256.c setopt.c curl_path.c curl_ctype.c curl_range.c
+  mime.c sha256.c setopt.c curl_path.c curl_ctype.c curl_range.c psl.c
 
 LIB_HFILES = arpa_telnet.h netrc.h file.h timeval.h hostip.h progress.h \
   formdata.h cookie.h http.h sendf.h ftp.h url.h dict.h if2ip.h         \
@@ -74,7 +74,7 @@ LIB_HFILES = arpa_telnet.h netrc.h file.h timeval.h hostip.h 
progress.h \
   curl_setup_once.h multihandle.h setup-vms.h pipeline.h dotdot.h       \
   x509asn1.h http2.h sigpipe.h smb.h curl_endian.h curl_des.h           \
   curl_printf.h system_win32.h rand.h mime.h curl_sha256.h setopt.h     \
-  curl_path.h curl_ctype.h curl_range.h
+  curl_path.h curl_ctype.h curl_range.h psl.h
 
 LIB_RCFILES = libcurl.rc
 
diff --git a/lib/Makefile.netware b/lib/Makefile.netware
index 005d83f43..788de2a00 100644
--- a/lib/Makefile.netware
+++ b/lib/Makefile.netware
@@ -166,7 +166,7 @@ endif
        CFLAGS += -align 4
 else
        # PRELUDE = $(NDK_CLIB)/imports/clibpre.o
-       # to avoid the __init_* / __deinit_* whoes don't use prelude from NDK
+       # to avoid the __init_* / __deinit_* woes don't use prelude from NDK
        PRELUDE = "$(MWCW_PATH)/libraries/runtime/prelude.obj"
        # CFLAGS += -include "$(MWCW_PATH)/headers/nlm_clib_prefix.h"
        CFLAGS += -align 1
@@ -192,7 +192,7 @@ else
 endif
 else
        PRELUDE = $(NDK_CLIB)/imports/clibpre.gcc.o
-       # to avoid the __init_* / __deinit_* whoes don't use prelude from NDK
+       # to avoid the __init_* / __deinit_* woes don't use prelude from NDK
        # http://www.gknw.net/development/mk_nlm/gcc_pre.zip
        # PRELUDE = $(NDK_ROOT)/pre/prelude.o
        CFLAGS += -include $(NDKBASE)/nlmconv/genlm.h
diff --git a/lib/asyn-ares.c b/lib/asyn-ares.c
index aa581a49a..00fe1adb5 100644
--- a/lib/asyn-ares.c
+++ b/lib/asyn-ares.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+ * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -312,22 +312,25 @@ CURLcode Curl_resolver_is_resolved(struct connectdata 
*conn,
     conn->async.os_specific;
   CURLcode result = CURLE_OK;
 
-  *dns = NULL;
+  if(dns)
+    *dns = NULL;
 
   waitperform(conn, 0);
 
   if(res && !res->num_pending) {
-    (void)Curl_addrinfo_callback(conn, res->last_status, res->temp_ai);
-    /* temp_ai ownership is moved to the connection, so we need not free-up
-       them */
-    res->temp_ai = NULL;
+    if(dns) {
+      (void)Curl_addrinfo_callback(conn, res->last_status, res->temp_ai);
+      /* temp_ai ownership is moved to the connection, so we need not free-up
+         them */
+      res->temp_ai = NULL;
+    }
     if(!conn->async.dns) {
       failf(data, "Could not resolve: %s (%s)",
             conn->async.hostname, ares_strerror(conn->async.status));
       result = conn->bits.proxy?CURLE_COULDNT_RESOLVE_PROXY:
         CURLE_COULDNT_RESOLVE_HOST;
     }
-    else
+    else if(dns)
       *dns = conn->async.dns;
 
     destroy_async_data(&conn->async);
@@ -390,7 +393,7 @@ CURLcode Curl_resolver_wait_resolv(struct connectdata *conn,
       timeout_ms = 1000;
 
     waitperform(conn, timeout_ms);
-    result = Curl_resolver_is_resolved(conn, &temp_entry);
+    result = Curl_resolver_is_resolved(conn, entry?&temp_entry:NULL);
 
     if(result || conn->async.done)
       break;
diff --git a/lib/asyn-thread.c b/lib/asyn-thread.c
index b11fab246..c7c1a0086 100644
--- a/lib/asyn-thread.c
+++ b/lib/asyn-thread.c
@@ -481,8 +481,10 @@ CURLcode Curl_resolver_wait_resolv(struct connectdata 
*conn,
   DEBUGASSERT(conn && td);
 
   /* wait for the thread to resolve the name */
-  if(Curl_thread_join(&td->thread_hnd))
-    result = getaddrinfo_complete(conn);
+  if(Curl_thread_join(&td->thread_hnd)) {
+    if(entry)
+      result = getaddrinfo_complete(conn);
+  }
   else
     DEBUGASSERT(0);
 
@@ -572,10 +574,10 @@ int Curl_resolver_getsock(struct connectdata *conn,
   (void)socks;
   (void)numsocks;
   ms = Curl_timediff(Curl_now(), reslv->start);
-  if(ms < 10)
-    milli = ms/3;
+  if(ms < 3)
+    milli = 0;
   else if(ms <= 50)
-    milli = 10;
+    milli = ms/3;
   else if(ms <= 250)
     milli = 50;
   else
diff --git a/lib/base64.c b/lib/base64.c
index 204a2273d..6370e4cdf 100644
--- a/lib/base64.c
+++ b/lib/base64.c
@@ -49,13 +49,12 @@ static size_t decodeQuantum(unsigned char *dest, const char 
*src)
   unsigned long i, x = 0;
 
   for(i = 0, s = src; i < 4; i++, s++) {
-    unsigned long v = 0;
-
     if(*s == '=') {
       x = (x << 6);
       padding++;
     }
     else {
+      unsigned long v = 0;
       p = base64;
 
       while(*p && (*p != *s)) {
diff --git a/lib/checksrc.pl b/lib/checksrc.pl
index c90e245ee..daff07bf5 100755
--- a/lib/checksrc.pl
+++ b/lib/checksrc.pl
@@ -63,6 +63,7 @@ my %warnings = (
     'NOSPACEEQUALS'    => 'equals sign without preceding space',
     'SEMINOSPACE'      => 'semicolon without following space',
     'MULTISPACE'       => 'multiple spaces used when not suitable',
+    'SIZEOFNOPAREN'    => 'use of sizeof without parentheses',
     );
 
 sub readwhitelist {
@@ -417,6 +418,17 @@ sub scanfile {
             }
         }
 
+        # check for "sizeof" without parenthesis
+        if(($l =~ /^(.*)sizeof *([ (])/) && ($2 ne "(")) {
+            if($1 =~ / *\#/) {
+                # this is a #if, treat it differently
+            }
+            else {
+                checkwarn("SIZEOFNOPAREN", $line, length($1)+6, $file, $l,
+                          "sizeof without parenthesis");
+            }
+        }
+
         # check for comma without space
         if($l =~ /^(.*),[^ \n]/) {
             my $pref=$1;
diff --git a/lib/conncache.c b/lib/conncache.c
index 2b752ed22..335c0c43d 100644
--- a/lib/conncache.c
+++ b/lib/conncache.c
@@ -6,7 +6,7 @@
  *                             \___|\___/|_| \_\_____|
  *
  * Copyright (C) 2012 - 2016, Linus Nielsen Feltzing, <address@hidden>
- * Copyright (C) 2012 - 2017, Daniel Stenberg, <address@hidden>, et al.
+ * Copyright (C) 2012 - 2018, Daniel Stenberg, <address@hidden>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -96,14 +96,13 @@ static void bundle_destroy(struct connectbundle *cb_ptr)
 }
 
 /* Add a connection to a bundle */
-static CURLcode bundle_add_conn(struct connectbundle *cb_ptr,
-                                struct connectdata *conn)
+static void bundle_add_conn(struct connectbundle *cb_ptr,
+                            struct connectdata *conn)
 {
   Curl_llist_insert_next(&cb_ptr->conn_list, cb_ptr->conn_list.tail, conn,
                          &conn->bundle_node);
   conn->bundle = cb_ptr;
   cb_ptr->num_connections++;
-  return CURLE_OK;
 }
 
 /* Remove a connection from a bundle */
@@ -263,7 +262,7 @@ static void conncache_remove_bundle(struct conncache *connc,
 CURLcode Curl_conncache_add_conn(struct conncache *connc,
                                  struct connectdata *conn)
 {
-  CURLcode result;
+  CURLcode result = CURLE_OK;
   struct connectbundle *bundle;
   struct connectbundle *new_bundle = NULL;
   struct Curl_easy *data = conn->data;
@@ -290,19 +289,13 @@ CURLcode Curl_conncache_add_conn(struct conncache *connc,
     bundle = new_bundle;
   }
 
-  result = bundle_add_conn(bundle, conn);
-  if(result) {
-    if(new_bundle)
-      conncache_remove_bundle(data->state.conn_cache, new_bundle);
-    goto unlock;
-  }
-
+  bundle_add_conn(bundle, conn);
   conn->connection_id = connc->next_connection_id++;
   connc->num_conn++;
 
   DEBUGF(infof(conn->data, "Added connection %ld. "
-               "The cache now contains %" CURL_FORMAT_CURL_OFF_TU " members\n",
-               conn->connection_id, (curl_off_t) connc->num_conn));
+               "The cache now contains %zu members\n",
+               conn->connection_id, connc->num_conn));
 
   unlock:
   CONN_UNLOCK(data);
@@ -328,9 +321,8 @@ void Curl_conncache_remove_conn(struct connectdata *conn, 
bool lock)
     conn->bundle = NULL; /* removed from it */
     if(connc) {
       connc->num_conn--;
-      DEBUGF(infof(conn->data, "The cache now contains %"
-                   CURL_FORMAT_CURL_OFF_TU " members\n",
-                   (curl_off_t) connc->num_conn));
+      DEBUGF(infof(conn->data, "The cache now contains %zu members\n",
+                   connc->num_conn));
     }
     if(lock) {
       CONN_UNLOCK(conn->data);
@@ -452,6 +444,7 @@ bool Curl_conncache_return_conn(struct connectdata *conn)
   }
   CONN_LOCK(data);
   conn->inuse = FALSE; /* Mark the connection unused */
+  conn->data = NULL; /* no owner */
   CONN_UNLOCK(data);
 
   return (conn_candidate == conn) ? FALSE : TRUE;
@@ -501,9 +494,8 @@ Curl_conncache_extract_bundle(struct Curl_easy *data,
     /* remove it to prevent another thread from nicking it */
     bundle_remove_conn(bundle, conn_candidate);
     data->state.conn_cache->num_conn--;
-    DEBUGF(infof(data, "The cache now contains %"
-                 CURL_FORMAT_CURL_OFF_TU " members\n",
-                 (curl_off_t) data->state.conn_cache->num_conn));
+    DEBUGF(infof(data, "The cache now contains %zu members\n",
+                 data->state.conn_cache->num_conn));
   }
 
   return conn_candidate;
@@ -563,9 +555,8 @@ Curl_conncache_extract_oldest(struct Curl_easy *data)
     /* remove it to prevent another thread from nicking it */
     bundle_remove_conn(bundle_candidate, conn_candidate);
     connc->num_conn--;
-    DEBUGF(infof(data, "The cache now contains %"
-                 CURL_FORMAT_CURL_OFF_TU " members\n",
-                 (curl_off_t) connc->num_conn));
+    DEBUGF(infof(data, "The cache now contains %zu members\n",
+                 connc->num_conn));
   }
   CONN_UNLOCK(data);
 
diff --git a/lib/conncache.h b/lib/conncache.h
index d8ad80f96..eedd7a800 100644
--- a/lib/conncache.h
+++ b/lib/conncache.h
@@ -7,7 +7,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 2015 - 2017, Daniel Stenberg, <address@hidden>, et al.
+ * Copyright (C) 2015 - 2018, Daniel Stenberg, <address@hidden>, et al.
  * Copyright (C) 2012 - 2014, Linus Nielsen Feltzing, <address@hidden>
  *
  * This software is licensed as described in the file COPYING, which
@@ -63,7 +63,7 @@ size_t Curl_conncache_bundle_size(struct connectdata *conn);
 
 bool Curl_conncache_return_conn(struct connectdata *conn);
 CURLcode Curl_conncache_add_conn(struct conncache *connc,
-                                 struct connectdata *conn);
+                                 struct connectdata *conn) WARN_UNUSED_RESULT;
 void Curl_conncache_remove_conn(struct connectdata *conn,
                                 bool lock);
 bool Curl_conncache_foreach(struct Curl_easy *data,
diff --git a/lib/connect.c b/lib/connect.c
index 1a27ae135..41f220268 100644
--- a/lib/connect.c
+++ b/lib/connect.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+ * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -1237,8 +1237,6 @@ static int conn_is_conn(struct connectdata *conn, void 
*param)
 curl_socket_t Curl_getconnectinfo(struct Curl_easy *data,
                                   struct connectdata **connp)
 {
-  curl_socket_t sockfd;
-
   DEBUGASSERT(data);
 
   /* this works for an easy handle:
@@ -1261,15 +1259,15 @@ curl_socket_t Curl_getconnectinfo(struct Curl_easy 
*data,
       return CURL_SOCKET_BAD;
     }
 
-    if(connp)
+    if(connp) {
       /* only store this if the caller cares for it */
       *connp = c;
-    sockfd = c->sock[FIRSTSOCKET];
+      c->data = data;
+    }
+    return c->sock[FIRSTSOCKET];
   }
   else
     return CURL_SOCKET_BAD;
-
-  return sockfd;
 }
 
 /*
diff --git a/lib/content_encoding.c b/lib/content_encoding.c
index 5a32d0791..1a5235bdc 100644
--- a/lib/content_encoding.c
+++ b/lib/content_encoding.c
@@ -163,7 +163,6 @@ static CURLcode inflate_stream(struct connectdata *conn,
   z_stream *z = &zp->z;         /* zlib state structure */
   uInt nread = z->avail_in;
   Bytef *orig_in = z->next_in;
-  int status;                   /* zlib status */
   bool done = FALSE;
   CURLcode result = CURLE_OK;   /* Curl_client_write status */
   char *decomp;                 /* Put the decompressed data here. */
@@ -184,13 +183,20 @@ static CURLcode inflate_stream(struct connectdata *conn,
   /* because the buffer size is fixed, iteratively decompress and transfer to
      the client via downstream_write function. */
   while(!done) {
+    int status;                   /* zlib status */
     done = TRUE;
 
     /* (re)set buffer for decompressed output for every iteration */
     z->next_out = (Bytef *) decomp;
     z->avail_out = DSIZ;
 
+#ifdef Z_BLOCK
+    /* Z_BLOCK is only available in zlib ver. >= 1.2.0.5 */
     status = inflate(z, Z_BLOCK);
+#else
+    /* fallback for zlib ver. < 1.2.0.5 */
+    status = inflate(z, Z_SYNC_FLUSH);
+#endif
 
     /* Flush output data if some. */
     if(z->avail_out != DSIZ) {
@@ -755,7 +761,6 @@ char *Curl_all_content_encodings(void)
   const content_encoding * const *cep;
   const content_encoding *ce;
   char *ace;
-  char *p;
 
   for(cep = encodings; *cep; cep++) {
     ce = *cep;
@@ -768,7 +773,7 @@ char *Curl_all_content_encodings(void)
 
   ace = malloc(len);
   if(ace) {
-    p = ace;
+    char *p = ace;
     for(cep = encodings; *cep; cep++) {
       ce = *cep;
       if(!strcasecompare(ce->name, CONTENT_ENCODING_DEFAULT)) {
@@ -915,10 +920,9 @@ void Curl_unencode_cleanup(struct connectdata *conn)
 static const content_encoding *find_encoding(const char *name, size_t len)
 {
   const content_encoding * const *cep;
-  const content_encoding *ce;
 
   for(cep = encodings; *cep; cep++) {
-    ce = *cep;
+    const content_encoding *ce = *cep;
     if((strncasecompare(name, ce->name, len) && !ce->name[len]) ||
        (ce->alias && strncasecompare(name, ce->alias, len) && !ce->alias[len]))
       return ce;
diff --git a/lib/cookie.c b/lib/cookie.c
index 29f627fd4..72aaa7636 100644
--- a/lib/cookie.c
+++ b/lib/cookie.c
@@ -84,12 +84,9 @@ Example set of cookies:
 
 #if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_COOKIES)
 
-#ifdef USE_LIBPSL
-# include <libpsl.h>
-#endif
-
 #include "urldata.h"
 #include "cookie.h"
+#include "psl.h"
 #include "strtok.h"
 #include "sendf.h"
 #include "slist.h"
@@ -379,13 +376,13 @@ static void strstore(char **str, const char *newstr)
  */
 static void remove_expired(struct CookieInfo *cookies)
 {
-  struct Cookie *co, *nx, *pv;
+  struct Cookie *co, *nx;
   curl_off_t now = (curl_off_t)time(NULL);
   unsigned int i;
 
   for(i = 0; i < COOKIE_HASH_SIZE; i++) {
+    struct Cookie *pv = NULL;
     co = cookies->cookies[i];
-    pv = NULL;
     while(co) {
       nx = co->next;
       if(co->expires && co->expires < now) {
@@ -406,6 +403,12 @@ static void remove_expired(struct CookieInfo *cookies)
   }
 }
 
+/* Make sure domain contains a dot or is localhost. */
+static bool bad_domain(const char *domain)
+{
+  return !strchr(domain, '.') && !strcasecompare(domain, "localhost");
+}
+
 /****************************************************************************
  *
  * Curl_cookie_add()
@@ -442,10 +445,6 @@ Curl_cookie_add(struct Curl_easy *data,
   bool badcookie = FALSE; /* cookies are good by default. mmmmm yummy */
   size_t myhash;
 
-#ifdef USE_LIBPSL
-  const psl_ctx_t *psl;
-#endif
-
 #ifdef CURL_DISABLE_VERBOSE_STRINGS
   (void)data;
 #endif
@@ -497,7 +496,7 @@ Curl_cookie_add(struct Curl_easy *data,
              name + contents. Chrome and Firefox support 4095 or 4096 bytes
              combo. */
           freecookie(co);
-          infof(data, "oversized cookie dropped, name/val %d + %d bytes\n",
+          infof(data, "oversized cookie dropped, name/val %zu + %zu bytes\n",
                 nlen, len);
           return NULL;
         }
@@ -585,13 +584,8 @@ Curl_cookie_add(struct Curl_easy *data,
            * TLD or otherwise "protected" suffix. To reduce risk, we require a
            * dot OR the exact host name being "localhost".
            */
-          {
-            const char *dotp;
-            /* check for more dots */
-            dotp = strchr(whatptr, '.');
-            if(!dotp && !strcasecompare("localhost", whatptr))
-              domain = ":";
-          }
+          if(bad_domain(whatptr))
+            domain = ":";
 #endif
 
           is_ip = isip(domain ? domain : whatptr);
@@ -890,14 +884,21 @@ Curl_cookie_add(struct Curl_easy *data,
     remove_expired(c);
 
 #ifdef USE_LIBPSL
-  /* Check if the domain is a Public Suffix and if yes, ignore the cookie.
-     This needs a libpsl compiled with builtin data. */
+  /* Check if the domain is a Public Suffix and if yes, ignore the cookie. */
   if(domain && co->domain && !isip(co->domain)) {
-    psl = psl_builtin();
-    if(psl && !psl_is_cookie_domain_acceptable(psl, domain, co->domain)) {
-      infof(data,
-            "cookie '%s' dropped, domain '%s' must not set cookies for '%s'\n",
-            co->name, domain, co->domain);
+    const psl_ctx_t *psl = Curl_psl_use(data);
+    int acceptable;
+
+    if(psl) {
+      acceptable = psl_is_cookie_domain_acceptable(psl, domain, co->domain);
+      Curl_psl_release(data);
+    }
+    else
+      acceptable = !bad_domain(domain);
+
+    if(!acceptable) {
+      infof(data, "cookie '%s' dropped, domain '%s' must not "
+                  "set cookies for '%s'\n", co->name, domain, co->domain);
       freecookie(co);
       return NULL;
     }
@@ -1384,9 +1385,8 @@ void Curl_cookie_clearsess(struct CookieInfo *cookies)
  ****************************************************************************/
 void Curl_cookie_cleanup(struct CookieInfo *c)
 {
-  unsigned int i;
-
   if(c) {
+    unsigned int i;
     free(c->filename);
     for(i = 0; i < COOKIE_HASH_SIZE; i++)
       Curl_cookie_freelist(c->cookies[i]);
diff --git a/lib/curl_addrinfo.c b/lib/curl_addrinfo.c
index 8ef1cfc68..af1e65cef 100644
--- a/lib/curl_addrinfo.c
+++ b/lib/curl_addrinfo.c
@@ -536,7 +536,8 @@ Curl_addrinfo *Curl_unix2addr(const char *path, bool 
*longpath, bool abstract)
 }
 #endif
 
-#if defined(CURLDEBUG) && defined(HAVE_FREEADDRINFO)
+#if defined(CURLDEBUG) && defined(HAVE_GETADDRINFO) &&  \
+  defined(HAVE_FREEADDRINFO)
 /*
  * curl_dofreeaddrinfo()
  *
diff --git a/lib/curl_config.h.cmake b/lib/curl_config.h.cmake
index 4b12083f2..ab0094be5 100644
--- a/lib/curl_config.h.cmake
+++ b/lib/curl_config.h.cmake
@@ -235,6 +235,9 @@
 /* Define to 1 if you have the `getpwuid' function. */
 #cmakedefine HAVE_GETPWUID 1
 
+/* Define to 1 if you have the `getpwuid_r' function. */
+#cmakedefine HAVE_GETPWUID_R 1
+
 /* Define to 1 if you have the `getrlimit' function. */
 #cmakedefine HAVE_GETRLIMIT 1
 
@@ -963,6 +966,9 @@
 /* to enable Windows SSL  */
 #cmakedefine USE_SCHANNEL 1
 
+/* enable multiple SSL backends */
+#cmakedefine CURL_WITH_MULTI_SSL 1
+
 /* Define to 1 if using yaSSL in OpenSSL compatibility mode. */
 #cmakedefine USE_YASSLEMUL 1
 
diff --git a/lib/curl_fnmatch.c b/lib/curl_fnmatch.c
index c6c905600..cad851569 100644
--- a/lib/curl_fnmatch.c
+++ b/lib/curl_fnmatch.c
@@ -30,6 +30,17 @@
 /* The last #include file should be: */
 #include "memdebug.h"
 
+#ifndef HAVE_FNMATCH
+
+/*
+ * TODO:
+ *
+ * Make this function match POSIX. Test 1307 includes a set of test patterns
+ * that returns different results with a POSIX fnmatch() than with this
+ * implementation and this is considered a bug where POSIX is the guiding
+ * light.
+ */
+
 #define CURLFNM_CHARSET_LEN (sizeof(char) * 256)
 #define CURLFNM_CHSET_SIZE (CURLFNM_CHARSET_LEN + 15)
 
@@ -334,9 +345,9 @@ static int loop(const unsigned char *pattern, const 
unsigned char *string,
         s++;
         break;
       }
+      /* Syntax error in set; mismatch! */
+      return CURL_FNMATCH_NOMATCH;
 
-      /* Syntax error in set: this must be taken as a regular character. */
-      /* FALLTHROUGH */
     default:
       if(*p++ != *s++)
         return CURL_FNMATCH_NOMATCH;
@@ -355,5 +366,31 @@ int Curl_fnmatch(void *ptr, const char *pattern, const 
char *string)
   if(!pattern || !string) {
     return CURL_FNMATCH_FAIL;
   }
-  return loop((unsigned char *)pattern, (unsigned char *)string, 5);
+  return loop((unsigned char *)pattern, (unsigned char *)string, 2);
+}
+#else
+#include <fnmatch.h>
+/*
+ * @unittest: 1307
+ */
+int Curl_fnmatch(void *ptr, const char *pattern, const char *string)
+{
+  int rc;
+  (void)ptr; /* the argument is specified by the curl_fnmatch_callback
+                prototype, but not used by Curl_fnmatch() */
+  if(!pattern || !string) {
+    return CURL_FNMATCH_FAIL;
+  }
+  rc = fnmatch(pattern, string, 0);
+  switch(rc) {
+  case 0:
+    return CURL_FNMATCH_MATCH;
+  case FNM_NOMATCH:
+    return CURL_FNMATCH_NOMATCH;
+  default:
+    return CURL_FNMATCH_FAIL;
+  }
+  /* not reached */
 }
+
+#endif
diff --git a/lib/curl_sasl.c b/lib/curl_sasl.c
index 158ea004d..894e16c3d 100644
--- a/lib/curl_sasl.c
+++ b/lib/curl_sasl.c
@@ -146,7 +146,6 @@ CURLcode Curl_sasl_parse_url_auth_option(struct SASL *sasl,
                                          const char *value, size_t len)
 {
   CURLcode result = CURLE_OK;
-  unsigned int mechbit;
   size_t mechlen;
 
   if(!len)
@@ -160,7 +159,7 @@ CURLcode Curl_sasl_parse_url_auth_option(struct SASL *sasl,
   if(!strncmp(value, "*", len))
     sasl->prefmech = SASL_AUTH_DEFAULT;
   else {
-    mechbit = Curl_sasl_decode_mech(value, len, &mechlen);
+    unsigned int mechbit = Curl_sasl_decode_mech(value, len, &mechlen);
     if(mechbit && mechlen == len)
       sasl->prefmech |= mechbit;
     else
diff --git a/lib/curl_setup.h b/lib/curl_setup.h
index 0d5a577cc..748cce07d 100644
--- a/lib/curl_setup.h
+++ b/lib/curl_setup.h
@@ -217,7 +217,7 @@
 
 /*
  * Use getaddrinfo to resolve the IPv4 address literal. If the current network
- * interface doesn’t support IPv4, but supports IPv6, NAT64, and DNS64,
+ * interface doesn't support IPv4, but supports IPv6, NAT64, and DNS64,
  * performing this task will result in a synthesized IPv6 address.
  */
 #ifdef  __APPLE__
@@ -242,6 +242,7 @@
 #  if defined(_UNICODE) && !defined(UNICODE)
 #    define UNICODE
 #  endif
+#  include <winerror.h>
 #  include <windows.h>
 #  ifdef HAVE_WINSOCK2_H
 #    include <winsock2.h>
@@ -800,4 +801,11 @@ endings either CRLF or LF so 't' is appropriate.
 #define CURL_SA_FAMILY_T unsigned short
 #endif
 
+/* Some versions of the Android SDK is missing the declaration */
+#if defined(HAVE_GETPWUID_R) && defined(HAVE_DECL_GETPWUID_R_MISSING)
+struct passwd;
+int getpwuid_r(uid_t uid, struct passwd *pwd, char *buf,
+               size_t buflen, struct passwd **result);
+#endif
+
 #endif /* HEADER_CURL_SETUP_H */
diff --git a/lib/dict.c b/lib/dict.c
index e801cf704..43339076f 100644
--- a/lib/dict.c
+++ b/lib/dict.c
@@ -95,10 +95,7 @@ static char *unescape_word(struct Curl_easy *data, const 
char *inputbuff)
 {
   char *newp = NULL;
   char *dictp;
-  char *ptr;
   size_t len;
-  char ch;
-  int olen = 0;
 
   CURLcode result = Curl_urldecode(data, inputbuff, 0, &newp, &len, FALSE);
   if(!newp || result)
@@ -106,6 +103,9 @@ static char *unescape_word(struct Curl_easy *data, const 
char *inputbuff)
 
   dictp = malloc(((size_t)len)*2 + 1); /* add one for terminating zero */
   if(dictp) {
+    char *ptr;
+    char ch;
+    int olen = 0;
     /* According to RFC2229 section 2.2, these letters need to be escaped with
        \[letter] */
     for(ptr = newp;
diff --git a/lib/easy.c b/lib/easy.c
index 5f8d22c40..0b3912e66 100644
--- a/lib/easy.c
+++ b/lib/easy.c
@@ -113,7 +113,7 @@ static CURLcode win32_init(void)
   res = WSAStartup(wVersionRequested, &wsaData);
 
   if(res != 0)
-    /* Tell the user that we couldn't find a useable */
+    /* Tell the user that we couldn't find a usable */
     /* winsock.dll.     */
     return CURLE_FAILED_INIT;
 
@@ -125,7 +125,7 @@ static CURLcode win32_init(void)
 
   if(LOBYTE(wsaData.wVersion) != LOBYTE(wVersionRequested) ||
      HIBYTE(wsaData.wVersion) != HIBYTE(wVersionRequested) ) {
-    /* Tell the user that we couldn't find a useable */
+    /* Tell the user that we couldn't find a usable */
 
     /* winsock.dll. */
     WSACleanup();
@@ -661,38 +661,27 @@ static CURLcode easy_transfer(struct Curl_multi *multi)
   bool done = FALSE;
   CURLMcode mcode = CURLM_OK;
   CURLcode result = CURLE_OK;
-  struct curltime before;
-  int without_fds = 0;  /* count number of consecutive returns from
-                           curl_multi_wait() without any filedescriptors */
 
   while(!done && !mcode) {
     int still_running = 0;
     int rc;
 
-    before = Curl_now();
     mcode = curl_multi_wait(multi, NULL, 0, 1000, &rc);
 
     if(!mcode) {
       if(!rc) {
-        struct curltime after = Curl_now();
+        long sleep_ms;
 
         /* If it returns without any filedescriptor instantly, we need to
            avoid busy-looping during periods where it has nothing particular
            to wait for */
-        if(Curl_timediff(after, before) <= 10) {
-          without_fds++;
-          if(without_fds > 2) {
-            int sleep_ms = without_fds < 10 ? (1 << (without_fds - 1)) : 1000;
-            Curl_wait_ms(sleep_ms);
-          }
+        curl_multi_timeout(multi, &sleep_ms);
+        if(sleep_ms) {
+          if(sleep_ms > 1000)
+            sleep_ms = 1000;
+          Curl_wait_ms((int)sleep_ms);
         }
-        else
-          /* it wasn't "instant", restart counter */
-          without_fds = 0;
       }
-      else
-        /* got file descriptor, restart counter */
-        without_fds = 0;
 
       mcode = curl_multi_perform(multi, &still_running);
     }
diff --git a/lib/escape.c b/lib/escape.c
index 8c9449fd7..e74c3db5b 100644
--- a/lib/escape.c
+++ b/lib/escape.c
@@ -82,7 +82,6 @@ char *curl_easy_escape(struct Curl_easy *data, const char 
*string,
   size_t alloc;
   char *ns;
   char *testing_ptr = NULL;
-  unsigned char in; /* we need to treat the characters unsigned */
   size_t newlen;
   size_t strindex = 0;
   size_t length;
@@ -100,7 +99,7 @@ char *curl_easy_escape(struct Curl_easy *data, const char 
*string,
 
   length = alloc-1;
   while(length--) {
-    in = *string;
+    unsigned char in = *string; /* we need to treat the characters unsigned */
 
     if(Curl_isunreserved(in))
       /* just copy this */
@@ -150,7 +149,6 @@ CURLcode Curl_urldecode(struct Curl_easy *data,
 {
   size_t alloc = (length?length:strlen(string)) + 1;
   char *ns = malloc(alloc);
-  unsigned char in;
   size_t strindex = 0;
   unsigned long hex;
   CURLcode result;
@@ -159,7 +157,7 @@ CURLcode Curl_urldecode(struct Curl_easy *data,
     return CURLE_OUT_OF_MEMORY;
 
   while(--alloc > 0) {
-    in = *string;
+    unsigned char in = *string;
     if(('%' == in) && (alloc > 2) &&
        ISXDIGIT(string[1]) && ISXDIGIT(string[2])) {
       /* this is two hexadecimal digits following a '%' */
diff --git a/lib/file.c b/lib/file.c
index 9e7645679..e4ac8dfa4 100644
--- a/lib/file.c
+++ b/lib/file.c
@@ -256,8 +256,6 @@ static CURLcode file_upload(struct connectdata *conn)
   CURLcode result = CURLE_OK;
   struct Curl_easy *data = conn->data;
   char *buf = data->state.buffer;
-  size_t nread;
-  size_t nwrite;
   curl_off_t bytecount = 0;
   struct_stat file_stat;
   const char *buf2;
@@ -306,6 +304,8 @@ static CURLcode file_upload(struct connectdata *conn)
   }
 
   while(!result) {
+    size_t nread;
+    size_t nwrite;
     int readcount;
     result = Curl_fillreadbuffer(conn, (int)data->set.buffer_size, &readcount);
     if(result)
@@ -378,7 +378,6 @@ static CURLcode file_do(struct connectdata *conn, bool 
*done)
   curl_off_t expected_size = 0;
   bool size_known;
   bool fstated = FALSE;
-  ssize_t nread;
   struct Curl_easy *data = conn->data;
   char *buf = data->state.buffer;
   curl_off_t bytecount = 0;
@@ -461,7 +460,7 @@ static CURLcode file_do(struct connectdata *conn, bool 
*done)
     return result;
 
   /* Adjust the start offset in case we want to get the N last bytes
-   * of the stream iff the filesize could be determined */
+   * of the stream if the filesize could be determined */
   if(data->state.resume_from < 0) {
     if(!fstated) {
       failf(data, "Can't get the size of file.");
@@ -502,6 +501,7 @@ static CURLcode file_do(struct connectdata *conn, bool 
*done)
   Curl_pgrsTime(data, TIMER_STARTTRANSFER);
 
   while(!result) {
+    ssize_t nread;
     /* Don't fill a whole buffer if we want less than all data */
     size_t bytestoread;
 
diff --git a/lib/formdata.c b/lib/formdata.c
index 3bb451b49..ba683e976 100644
--- a/lib/formdata.c
+++ b/lib/formdata.c
@@ -724,7 +724,7 @@ int curl_formget(struct curl_httppost *form, void *arg,
 
   while(!result) {
     char buffer[8192];
-    size_t nread = Curl_mime_read(buffer, 1, sizeof buffer, &toppart);
+    size_t nread = Curl_mime_read(buffer, 1, sizeof(buffer), &toppart);
 
     if(!nread)
       break;
@@ -811,7 +811,6 @@ CURLcode Curl_getformdata(struct Curl_easy *data,
 {
   CURLcode result = CURLE_OK;
   curl_mime *form = NULL;
-  curl_mime *multipart;
   curl_mimepart *part;
   struct curl_httppost *file;
 
@@ -830,7 +829,7 @@ CURLcode Curl_getformdata(struct Curl_easy *data,
   /* Process each top part. */
   for(; !result && post; post = post->next) {
     /* If we have more than a file here, create a mime subpart and fill it. */
-    multipart = form;
+    curl_mime *multipart = form;
     if(post->more) {
       part = curl_mime_addpart(form);
       if(!part)
diff --git a/lib/ftp.c b/lib/ftp.c
index 9c434af80..4aef06227 100644
--- a/lib/ftp.c
+++ b/lib/ftp.c
@@ -239,8 +239,8 @@ static void close_secondarysocket(struct connectdata *conn)
 
 static void freedirs(struct ftp_conn *ftpc)
 {
-  int i;
   if(ftpc->dirs) {
+    int i;
     for(i = 0; i < ftpc->dirdepth; i++) {
       free(ftpc->dirs[i]);
       ftpc->dirs[i] = NULL;
@@ -637,8 +637,6 @@ CURLcode Curl_GetFTPResponse(ssize_t *nreadp, /* return 
number of bytes read */
    * line in a response or continue reading.  */
 
   curl_socket_t sockfd = conn->sock[FIRSTSOCKET];
-  time_t timeout;              /* timeout in milliseconds */
-  time_t interval_ms;
   struct Curl_easy *data = conn->data;
   CURLcode result = CURLE_OK;
   struct ftp_conn *ftpc = &conn->proto.ftpc;
@@ -657,7 +655,8 @@ CURLcode Curl_GetFTPResponse(ssize_t *nreadp, /* return 
number of bytes read */
 
   while(!*ftpcode && !result) {
     /* check and reset timeout value every lap */
-    timeout = Curl_pp_state_timeout(pp);
+    time_t timeout = Curl_pp_state_timeout(pp); /* timeout in milliseconds */
+    time_t interval_ms;
 
     if(timeout <= 0) {
       failf(data, "FTP response timeout");
@@ -1589,7 +1588,6 @@ static CURLcode ftp_state_ul_setup(struct connectdata 
*conn,
   struct FTP *ftp = conn->data->req.protop;
   struct Curl_easy *data = conn->data;
   struct ftp_conn *ftpc = &conn->proto.ftpc;
-  int seekerr = CURL_SEEKFUNC_OK;
 
   if((data->state.resume_from && !sizechecked) ||
      ((data->state.resume_from > 0) && sizechecked)) {
@@ -1605,6 +1603,7 @@ static CURLcode ftp_state_ul_setup(struct connectdata 
*conn,
     /* 3. pass file-size number of bytes in the source file */
     /* 4. lower the infilesize counter */
     /* => transfer as usual */
+    int seekerr = CURL_SEEKFUNC_OK;
 
     if(data->state.resume_from < 0) {
       /* Got no given size to start from, figure it out */
@@ -2782,7 +2781,6 @@ static CURLcode ftp_statemach_act(struct connectdata 
*conn)
         char *ptr = &data->state.buffer[4];  /* start on the first letter */
         const size_t buf_size = data->set.buffer_size;
         char *dir;
-        char *store;
         bool entry_extracted = FALSE;
 
         dir = malloc(nread + 1);
@@ -2805,6 +2803,7 @@ static CURLcode ftp_statemach_act(struct connectdata 
*conn)
 
         if('\"' == *ptr) {
           /* it started good */
+          char *store;
           ptr++;
           for(store = dir; *ptr;) {
             if('\"' == *ptr) {
@@ -3992,8 +3991,7 @@ CURLcode Curl_ftpsend(struct connectdata *conn, const 
char *cmd)
       break;
 
     if(conn->data->set.verbose)
-      Curl_debug(conn->data, CURLINFO_HEADER_OUT,
-                 sptr, (size_t)bytes_written, conn);
+      Curl_debug(conn->data, CURLINFO_HEADER_OUT, sptr, (size_t)bytes_written);
 
     if(bytes_written != (ssize_t)write_len) {
       write_len -= bytes_written;
@@ -4384,7 +4382,6 @@ static CURLcode ftp_setup_connection(struct connectdata 
*conn)
 {
   struct Curl_easy *data = conn->data;
   char *type;
-  char command;
   struct FTP *ftp;
 
   conn->data->req.protop = ftp = malloc(sizeof(struct FTP));
@@ -4402,6 +4399,7 @@ static CURLcode ftp_setup_connection(struct connectdata 
*conn)
     type = strstr(conn->host.rawalloc, ";type=");
 
   if(type) {
+    char command;
     *type = 0;                     /* it was in the middle of the hostname */
     command = Curl_raw_toupper(type[6]);
     conn->bits.type_set = TRUE;
diff --git a/lib/getinfo.c b/lib/getinfo.c
index 45e7c39bd..23c326051 100644
--- a/lib/getinfo.c
+++ b/lib/getinfo.c
@@ -281,6 +281,28 @@ static CURLcode getinfo_offt(struct Curl_easy *data, 
CURLINFO info,
     *param_offt = (data->progress.flags & PGRS_UL_SIZE_KNOWN)?
       data->progress.size_ul:-1;
     break;
+  case CURLINFO_TOTAL_TIME_T:
+    *param_offt = data->progress.timespent;
+    break;
+  case CURLINFO_NAMELOOKUP_TIME_T:
+    *param_offt = data->progress.t_nslookup;
+    break;
+  case CURLINFO_CONNECT_TIME_T:
+    *param_offt = data->progress.t_connect;
+    break;
+  case CURLINFO_APPCONNECT_TIME_T:
+    *param_offt = data->progress.t_appconnect;
+    break;
+  case CURLINFO_PRETRANSFER_TIME_T:
+    *param_offt = data->progress.t_pretransfer;
+    break;
+  case CURLINFO_STARTTRANSFER_TIME_T:
+    *param_offt = data->progress.t_starttransfer;
+    break;
+  case CURLINFO_REDIRECT_TIME_T:
+    *param_offt = data->progress.t_redirect;
+    break;
+
   default:
     return CURLE_UNKNOWN_OPTION;
   }
diff --git a/lib/hash.c b/lib/hash.c
index 56a019f05..9e6e3fcee 100644
--- a/lib/hash.c
+++ b/lib/hash.c
@@ -60,8 +60,6 @@ Curl_hash_init(struct curl_hash *h,
                comp_function comparator,
                curl_hash_dtor dtor)
 {
-  int i;
-
   if(!slots || !hfunc || !comparator ||!dtor) {
     return 1; /* failure */
   }
@@ -74,6 +72,7 @@ Curl_hash_init(struct curl_hash *h,
 
   h->table = malloc(slots * sizeof(struct curl_llist));
   if(h->table) {
+    int i;
     for(i = 0; i < slots; ++i)
       Curl_llist_init(&h->table[i], (curl_llist_dtor) hash_element_dtor);
     return 0; /* fine */
@@ -140,11 +139,10 @@ Curl_hash_add(struct curl_hash *h, void *key, size_t 
key_len, void *p)
 int Curl_hash_delete(struct curl_hash *h, void *key, size_t key_len)
 {
   struct curl_llist_element *le;
-  struct curl_hash_element  *he;
   struct curl_llist *l = FETCH_LIST(h, key, key_len);
 
   for(le = l->head; le; le = le->next) {
-    he = le->ptr;
+    struct curl_hash_element *he = le->ptr;
     if(h->comp_func(he->key, he->key_len, key, key_len)) {
       Curl_llist_remove(l, le, (void *) h);
       --h->size;
@@ -162,13 +160,12 @@ void *
 Curl_hash_pick(struct curl_hash *h, void *key, size_t key_len)
 {
   struct curl_llist_element *le;
-  struct curl_hash_element  *he;
   struct curl_llist *l;
 
   if(h) {
     l = FETCH_LIST(h, key, key_len);
     for(le = l->head; le; le = le->next) {
-      he = le->ptr;
+      struct curl_hash_element *he = le->ptr;
       if(h->comp_func(he->key, he->key_len, key, key_len)) {
         return he->ptr;
       }
@@ -291,7 +288,6 @@ void Curl_hash_start_iterate(struct curl_hash *hash,
 struct curl_hash_element *
 Curl_hash_next_element(struct curl_hash_iterator *iter)
 {
-  int i;
   struct curl_hash *h = iter->hash;
 
   /* Get the next element in the current list, if any */
@@ -300,6 +296,7 @@ Curl_hash_next_element(struct curl_hash_iterator *iter)
 
   /* If we have reached the end of the list, find the next one */
   if(!iter->current_element) {
+    int i;
     for(i = iter->slot_index; i < h->slots; i++) {
       if(h->table[i].head) {
         iter->current_element = h->table[i].head;
diff --git a/lib/hmac.c b/lib/hmac.c
index d7e495e16..f6a033c00 100644
--- a/lib/hmac.c
+++ b/lib/hmac.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2016, Daniel Stenberg, <address@hidden>, et al.
+ * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -58,7 +58,7 @@ Curl_HMAC_init(const HMAC_params * hashparams,
   unsigned char b;
 
   /* Create HMAC context. */
-  i = sizeof *ctxt + 2 * hashparams->hmac_ctxtsize +
+  i = sizeof(*ctxt) + 2 * hashparams->hmac_ctxtsize +
     hashparams->hmac_resultlen;
   ctxt = malloc(i);
 
diff --git a/lib/hostip.c b/lib/hostip.c
index c2f9defd9..d809578e1 100644
--- a/lib/hostip.c
+++ b/lib/hostip.c
@@ -1010,24 +1010,28 @@ CURLcode Curl_loadhostpairs(struct Curl_easy *data)
       /* See if its already in our dns cache */
       dns = Curl_hash_pick(data->dns.hostcache, entry_id, entry_len + 1);
 
+      if(dns) {
+        infof(data, "RESOLVE %s:%d is - old addresses discarded!\n",
+                hostname, port);
+        /* delete old entry entry, there are two reasons for this
+         1. old entry may have different addresses.
+         2. even if entry with correct addresses is already in the cache,
+            but if it is close to expire, then by the time next http
+            request is made, it can get expired and pruned because old
+            entry is not necessarily marked as added by CURLOPT_RESOLVE. */
+
+        Curl_hash_delete(data->dns.hostcache, entry_id, entry_len + 1);
+      }
       /* free the allocated entry_id again */
       free(entry_id);
 
-      if(!dns) {
-        /* if not in the cache already, put this host in the cache */
-        dns = Curl_cache_addr(data, head, hostname, port);
-        if(dns) {
-          dns->timestamp = 0; /* mark as added by CURLOPT_RESOLVE */
-          /* release the returned reference; the cache itself will keep the
-           * entry alive: */
-          dns->inuse--;
-        }
-      }
-      else {
-        /* this is a duplicate, free it again */
-        infof(data, "RESOLVE %s:%d is already cached, %s not stored!\n",
-              hostname, port, addresses);
-        Curl_freeaddrinfo(head);
+      /* put this new host in the cache */
+      dns = Curl_cache_addr(data, head, hostname, port);
+      if(dns) {
+        dns->timestamp = 0; /* mark as added by CURLOPT_RESOLVE */
+        /* release the returned reference; the cache itself will keep the
+         * entry alive: */
+            dns->inuse--;
       }
 
       if(data->share)
diff --git a/lib/hostip6.c b/lib/hostip6.c
index 7c9988f41..3bf47b467 100644
--- a/lib/hostip6.c
+++ b/lib/hostip6.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+ * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -59,39 +59,6 @@
 #include "curl_memory.h"
 #include "memdebug.h"
 
-#if defined(CURLDEBUG) && defined(HAVE_GETNAMEINFO)
-/* These are strictly for memory tracing and are using the same style as the
- * family otherwise present in memdebug.c. I put these ones here since they
- * require a bunch of structs I didn't want to include in memdebug.c
- */
-
-/*
- * For CURLRES_ARS, this should be written using ares_gethostbyaddr()
- * (ignoring the fact c-ares doesn't return 'serv').
- */
-
-int curl_dogetnameinfo(GETNAMEINFO_QUAL_ARG1 GETNAMEINFO_TYPE_ARG1 sa,
-                       GETNAMEINFO_TYPE_ARG2 salen,
-                       char *host, GETNAMEINFO_TYPE_ARG46 hostlen,
-                       char *serv, GETNAMEINFO_TYPE_ARG46 servlen,
-                       GETNAMEINFO_TYPE_ARG7 flags,
-                       int line, const char *source)
-{
-  int res = (getnameinfo)(sa, salen,
-                          host, hostlen,
-                          serv, servlen,
-                          flags);
-  if(0 == res)
-    /* success */
-    curl_memlog("GETNAME %s:%d getnameinfo()\n",
-                source, line);
-  else
-    curl_memlog("GETNAME %s:%d getnameinfo() failed = %d\n",
-                source, line, res);
-  return res;
-}
-#endif /* defined(CURLDEBUG) && defined(HAVE_GETNAMEINFO) */
-
 /*
  * Curl_ipv6works() returns TRUE if IPv6 seems to work.
  */
diff --git a/lib/http.c b/lib/http.c
index 1b3272174..588bab599 100644
--- a/lib/http.c
+++ b/lib/http.c
@@ -310,6 +310,31 @@ static CURLcode http_output_basic(struct connectdata 
*conn, bool proxy)
   return result;
 }
 
+/*
+ * http_output_bearer() sets up an Authorization: header
+ * for HTTP Bearer authentication.
+ *
+ * Returns CURLcode.
+ */
+static CURLcode http_output_bearer(struct connectdata *conn)
+{
+  char **userp;
+  CURLcode result = CURLE_OK;
+
+  userp = &conn->allocptr.userpwd;
+  free(*userp);
+  *userp = aprintf("Authorization: Bearer %s\r\n",
+                   conn->oauth_bearer);
+
+  if(!*userp) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto fail;
+  }
+
+  fail:
+  return result;
+}
+
 /* pickoneauth() selects the most favourable authentication method from the
  * ones available and the ones we want.
  *
@@ -326,6 +351,8 @@ static bool pickoneauth(struct auth *pick)
      of preference in case of the existence of multiple accepted types. */
   if(avail & CURLAUTH_NEGOTIATE)
     pick->picked = CURLAUTH_NEGOTIATE;
+  else if(avail & CURLAUTH_BEARER)
+    pick->picked = CURLAUTH_BEARER;
   else if(avail & CURLAUTH_DIGEST)
     pick->picked = CURLAUTH_DIGEST;
   else if(avail & CURLAUTH_NTLM)
@@ -628,6 +655,20 @@ output_auth_headers(struct connectdata *conn,
        functions work that way */
     authstatus->done = TRUE;
   }
+  if(authstatus->picked == CURLAUTH_BEARER) {
+    /* Bearer */
+    if((!proxy && conn->oauth_bearer &&
+        !Curl_checkheaders(conn, "Authorization:"))) {
+      auth = "Bearer";
+      result = http_output_bearer(conn);
+      if(result)
+        return result;
+    }
+
+    /* NOTE: this function should set 'done' TRUE, as the other auth
+       functions work that way */
+    authstatus->done = TRUE;
+  }
 
   if(auth) {
     infof(data, "%s auth using %s with user '%s'\n",
@@ -674,7 +715,7 @@ Curl_http_output_auth(struct connectdata *conn,
   authproxy = &data->state.authproxy;
 
   if((conn->bits.httpproxy && conn->bits.proxy_user_passwd) ||
-     conn->bits.user_passwd)
+     conn->bits.user_passwd || conn->oauth_bearer)
     /* continue please */;
   else {
     authhost->done = TRUE;
@@ -883,6 +924,18 @@ CURLcode Curl_http_input_auth(struct connectdata *conn, 
bool proxy,
               data->state.authproblem = TRUE;
             }
           }
+          else
+            if(checkprefix("Bearer", auth)) {
+              *availp |= CURLAUTH_BEARER;
+              authp->avail |= CURLAUTH_BEARER;
+              if(authp->picked == CURLAUTH_BEARER) {
+                /* We asked for Bearer authentication but got a 40X back
+                  anyway, which basically means our token isn't valid. */
+                authp->avail = CURLAUTH_NONE;
+                infof(data, "Authentication problem. Ignoring this.\n");
+                data->state.authproblem = TRUE;
+              }
+            }
 
     /* there may be multiple methods on one line, so keep reading */
     while(*auth && *auth != ',') /* read up to the next comma */
@@ -1128,12 +1181,12 @@ CURLcode Curl_add_buffer_send(Curl_send_buffer *in,
 
     if(conn->data->set.verbose) {
       /* this data _may_ contain binary stuff */
-      Curl_debug(conn->data, CURLINFO_HEADER_OUT, ptr, headlen, conn);
+      Curl_debug(conn->data, CURLINFO_HEADER_OUT, ptr, headlen);
       if(bodylen) {
         /* there was body data sent beyond the initial header part, pass that
            on to the debug callback too */
         Curl_debug(conn->data, CURLINFO_DATA_OUT,
-                   ptr + headlen, bodylen, conn);
+                   ptr + headlen, bodylen);
       }
     }
 
@@ -1223,7 +1276,6 @@ CURLcode Curl_add_bufferf(Curl_send_buffer *in, const 
char *fmt, ...)
 CURLcode Curl_add_buffer(Curl_send_buffer *in, const void *inptr, size_t size)
 {
   char *new_rb;
-  size_t new_size;
 
   if(~size < in->size_used) {
     /* If resulting used size of send buffer would wrap size_t, cleanup
@@ -1236,10 +1288,10 @@ CURLcode Curl_add_buffer(Curl_send_buffer *in, const 
void *inptr, size_t size)
 
   if(!in->buffer ||
      ((in->size_used + size) > (in->size_max - 1))) {
-
     /* If current buffer size isn't enough to hold the result, use a
        buffer size that doubles the required size. If this new size
        would wrap size_t, then just use the largest possible one */
+    size_t new_size;
 
     if((size > (size_t)-1 / 2) || (in->size_used > (size_t)-1 / 2) ||
        (~(size * 2) < (in->size_used * 2)))
@@ -1406,7 +1458,7 @@ static CURLcode add_haproxy_protocol_header(struct 
connectdata *conn)
   }
 
   snprintf(proxy_header,
-           sizeof proxy_header,
+           sizeof(proxy_header),
            "PROXY %s %s %s %li %li\r\n",
            tcp_version,
            conn->data->info.conn_local_ip,
@@ -1574,7 +1626,6 @@ static CURLcode expect100(struct Curl_easy *data,
                           Curl_send_buffer *req_buffer)
 {
   CURLcode result = CURLE_OK;
-  const char *ptr;
   data->state.expect100header = FALSE; /* default to false unless it is set
                                           to TRUE below */
   if(use_http_1_1plus(data, conn) &&
@@ -1582,7 +1633,7 @@ static CURLcode expect100(struct Curl_easy *data,
     /* if not doing HTTP 1.0 or version 2, or disabled explicitly, we add an
        Expect: 100-continue to the headers which actually speeds up post
        operations (as there is one packet coming back from the web server) */
-    ptr = Curl_checkheaders(conn, "Expect");
+    const char *ptr = Curl_checkheaders(conn, "Expect");
     if(ptr) {
       data->state.expect100header =
         Curl_compareheader(ptr, "Expect:", "100-continue");
@@ -1819,7 +1870,6 @@ CURLcode Curl_http(struct connectdata *conn, bool *done)
   const char *httpstring;
   Curl_send_buffer *req_buffer;
   curl_off_t postsize = 0; /* curl_off_t to handle large file sizes */
-  int seekerr = CURL_SEEKFUNC_CANTSEEK;
 
   /* Always consider the DO phase done after this function call, even if there
      may be parts of the request that is not yet sent, since we can deal with
@@ -2088,7 +2138,6 @@ CURLcode Curl_http(struct connectdata *conn, bool *done)
     else {
       /* If the host begins with '[', we start searching for the port after
          the bracket has been closed */
-      int startsearch = 0;
       if(*cookiehost == '[') {
         char *closingbracket;
         /* since the 'cookiehost' is an allocated memory area that will be
@@ -2099,6 +2148,7 @@ CURLcode Curl_http(struct connectdata *conn, bool *done)
           *closingbracket = 0;
       }
       else {
+        int startsearch = 0;
         char *colon = strchr(cookiehost + startsearch, ':');
         if(colon)
           *colon = 0; /* The host must not include an embedded port number */
@@ -2244,6 +2294,7 @@ CURLcode Curl_http(struct connectdata *conn, bool *done)
 
       /* Now, let's read off the proper amount of bytes from the
          input. */
+      int seekerr = CURL_SEEKFUNC_CANTSEEK;
       if(conn->seek_func) {
         Curl_set_in_callback(data, true);
         seekerr = conn->seek_func(conn->seek_client, data->state.resume_from,
@@ -2939,7 +2990,7 @@ static CURLcode header_append(struct Curl_easy *data,
     /* The reason to have a max limit for this is to avoid the risk of a bad
        server feeding libcurl with a never-ending header that will cause
        reallocs infinitely */
-    failf(data, "Rejected %zd bytes header (max is %d)!", newsize,
+    failf(data, "Rejected %zu bytes header (max is %d)!", newsize,
           CURL_MAX_HTTP_HEADER);
     return CURLE_OUT_OF_MEMORY;
   }
@@ -3354,7 +3405,7 @@ CURLcode Curl_http_readwrite_headers(struct Curl_easy 
*data,
 
         if(data->set.verbose)
           Curl_debug(data, CURLINFO_HEADER_IN,
-                     k->str_start, headerlen, conn);
+                     k->str_start, headerlen);
         break;          /* exit header line loop */
       }
 
@@ -3487,21 +3538,18 @@ CURLcode Curl_http_readwrite_headers(struct Curl_easy 
*data,
          * depending on how authentication is working.  Other codes
          * are definitely errors, so give up here.
          */
-        if(data->set.http_fail_on_error && (k->httpcode >= 400) &&
+        if(data->state.resume_from && data->set.httpreq == HTTPREQ_GET &&
+             k->httpcode == 416) {
+          /* "Requested Range Not Satisfiable", just proceed and
+             pretend this is no error */
+          k->ignorebody = TRUE; /* Avoid appending error msg to good data. */
+        }
+        else if(data->set.http_fail_on_error && (k->httpcode >= 400) &&
            ((k->httpcode != 401) || !conn->bits.user_passwd) &&
            ((k->httpcode != 407) || !conn->bits.proxy_user_passwd) ) {
-
-          if(data->state.resume_from &&
-             (data->set.httpreq == HTTPREQ_GET) &&
-             (k->httpcode == 416)) {
-            /* "Requested Range Not Satisfiable", just proceed and
-               pretend this is no error */
-          }
-          else {
-            /* serious error, go home! */
-            print_http_error(data);
-            return CURLE_HTTP_RETURNED_ERROR;
-          }
+          /* serious error, go home! */
+          print_http_error(data);
+          return CURLE_HTTP_RETURNED_ERROR;
         }
 
         if(conn->httpversion == 10) {
@@ -3812,8 +3860,7 @@ CURLcode Curl_http_readwrite_headers(struct Curl_easy 
*data,
       writetype |= CLIENTWRITE_BODY;
 
     if(data->set.verbose)
-      Curl_debug(data, CURLINFO_HEADER_IN,
-                 k->p, (size_t)k->hbuflen, conn);
+      Curl_debug(data, CURLINFO_HEADER_IN, k->p, (size_t)k->hbuflen);
 
     result = Curl_client_write(conn, writetype, k->p, k->hbuflen);
     if(result)
diff --git a/lib/http2.c b/lib/http2.c
index 20df99627..ecb263235 100644
--- a/lib/http2.c
+++ b/lib/http2.c
@@ -345,7 +345,7 @@ const char *Curl_http2_strerror(uint32_t err)
     "INADEQUATE_SECURITY",  /* 0xC */
     "HTTP_1_1_REQUIRED"     /* 0xD */
   };
-  return (err < sizeof str / sizeof str[0]) ? str[err] : "unknown";
+  return (err < sizeof(str) / sizeof(str[0])) ? str[err] : "unknown";
 #else
   return nghttp2_http2_strerror(err);
 #endif
@@ -581,7 +581,7 @@ static int on_frame_recv(nghttp2_session *session, const 
nghttp2_frame *frame,
       if(max_conn != httpc->settings.max_concurrent_streams) {
         /* only signal change if the value actually changed */
         infof(conn->data,
-              "Connection state changed (MAX_CONCURRENT_STREAMS == %d)!\n",
+              "Connection state changed (MAX_CONCURRENT_STREAMS == %u)!\n",
               httpc->settings.max_concurrent_streams);
         Curl_multi_connchanged(conn->data->multi);
       }
@@ -1280,7 +1280,7 @@ static int h2_process_pending_input(struct connectdata 
*conn,
   if(rv < 0) {
     failf(data,
           "h2_process_pending_input: nghttp2_session_mem_recv() returned "
-          "%d:%s\n", rv, nghttp2_strerror((int)rv));
+          "%zd:%s\n", rv, nghttp2_strerror((int)rv));
     *err = CURLE_RECV_ERROR;
     return -1;
   }
@@ -1388,7 +1388,7 @@ static ssize_t http2_handle_stream_close(struct 
connectdata *conn,
     return -1;
   }
   else if(httpc->error_code != NGHTTP2_NO_ERROR) {
-    failf(data, "HTTP/2 stream %u was not closed cleanly: %s (err %d)",
+    failf(data, "HTTP/2 stream %d was not closed cleanly: %s (err %u)",
           stream->stream_id, Curl_http2_strerror(httpc->error_code),
           httpc->error_code);
     *err = CURLE_HTTP2_STREAM;
@@ -1396,7 +1396,7 @@ static ssize_t http2_handle_stream_close(struct 
connectdata *conn,
   }
 
   if(!stream->bodystarted) {
-    failf(data, "HTTP/2 stream %u was closed cleanly, but before getting "
+    failf(data, "HTTP/2 stream %d was closed cleanly, but before getting "
           " all response header fields, treated as error",
           stream->stream_id);
     *err = CURLE_HTTP2_STREAM;
@@ -1552,7 +1552,7 @@ static ssize_t http2_recv(struct connectdata *conn, int 
sockindex,
     stream->pausedata += nread;
     stream->pauselen -= nread;
 
-    infof(data, "%zu data bytes written\n", nread);
+    infof(data, "%zd data bytes written\n", nread);
     if(stream->pauselen == 0) {
       H2BUGF(infof(data, "Unpaused by stream %u\n", stream->stream_id));
       DEBUGASSERT(httpc->pause_stream_id == stream->stream_id);
@@ -1635,7 +1635,7 @@ static ssize_t http2_recv(struct connectdata *conn, int 
sockindex,
     rv = nghttp2_session_mem_recv(httpc->h2, (const uint8_t *)inbuf, nread);
 
     if(nghttp2_is_fatal((int)rv)) {
-      failf(data, "nghttp2_session_mem_recv() returned %d:%s\n",
+      failf(data, "nghttp2_session_mem_recv() returned %zd:%s\n",
             rv, nghttp2_strerror((int)rv));
       *err = CURLE_RECV_ERROR;
       return -1;
@@ -2040,7 +2040,7 @@ static ssize_t http2_send(struct connectdata *conn, int 
sockindex,
   }
 
   infof(conn->data, "Using Stream ID: %x (easy handle %p)\n",
-        stream_id, conn->data);
+        stream_id, (void *)conn->data);
   stream->stream_id = stream_id;
 
   /* this does not call h2_session_send() since there can not have been any
diff --git a/lib/http_proxy.c b/lib/http_proxy.c
index 85e0be083..3a1a7f82f 100644
--- a/lib/http_proxy.c
+++ b/lib/http_proxy.c
@@ -188,7 +188,6 @@ static CURLcode CONNECT(struct connectdata *conn,
   struct SingleRequest *k = &data->req;
   CURLcode result;
   curl_socket_t tunnelsocket = conn->sock[sockindex];
-  timediff_t check;
   struct http_connect_state *s = conn->connect_state;
 
 #define SELECT_OK      0
@@ -201,12 +200,13 @@ static CURLcode CONNECT(struct connectdata *conn,
   conn->bits.proxy_connect_closed = FALSE;
 
   do {
+    timediff_t check;
     if(TUNNEL_INIT == s->tunnel_state) {
       /* BEGIN CONNECT PHASE */
       char *host_port;
       Curl_send_buffer *req_buffer;
 
-      infof(data, "Establish HTTP proxy tunnel to %s:%hu\n",
+      infof(data, "Establish HTTP proxy tunnel to %s:%d\n",
             hostname, remote_port);
 
         /* This only happens if we've looped here due to authentication
@@ -419,7 +419,7 @@ static CURLcode CONNECT(struct connectdata *conn,
         /* output debug if that is requested */
         if(data->set.verbose)
           Curl_debug(data, CURLINFO_HEADER_IN,
-                     s->line_start, (size_t)s->perline, conn);
+                     s->line_start, (size_t)s->perline);
 
         if(!data->set.suppress_connect_headers) {
           /* send the header to the callback */
diff --git a/lib/imap.c b/lib/imap.c
index 413932828..68820a5df 100644
--- a/lib/imap.c
+++ b/lib/imap.c
@@ -609,7 +609,6 @@ static CURLcode imap_perform_list(struct connectdata *conn)
   CURLcode result = CURLE_OK;
   struct Curl_easy *data = conn->data;
   struct IMAP *imap = data->req.protop;
-  char *mailbox;
 
   if(imap->custom)
     /* Send the custom request */
@@ -617,7 +616,8 @@ static CURLcode imap_perform_list(struct connectdata *conn)
                         imap->custom_params ? imap->custom_params : "");
   else {
     /* Make sure the mailbox is in the correct atom format if necessary */
-    mailbox = imap->mailbox ? imap_atom(imap->mailbox, true) : strdup("");
+    char *mailbox = imap->mailbox ? imap_atom(imap->mailbox, true)
+                                  : strdup("");
     if(!mailbox)
       return CURLE_OUT_OF_MEMORY;
 
@@ -854,7 +854,6 @@ static CURLcode imap_state_capability_resp(struct 
connectdata *conn,
   struct Curl_easy *data = conn->data;
   struct imap_conn *imapc = &conn->proto.imapc;
   const char *line = data->state.buffer;
-  size_t wordlen;
 
   (void)instate; /* no use for this yet */
 
@@ -864,6 +863,7 @@ static CURLcode imap_state_capability_resp(struct 
connectdata *conn,
 
     /* Loop through the data line */
     for(;;) {
+      size_t wordlen;
       while(*line &&
             (*line == ' ' || *line == '\t' ||
               *line == '\r' || *line == '\n')) {
@@ -1046,12 +1046,12 @@ static CURLcode imap_state_select_resp(struct 
connectdata *conn, int imapcode,
   struct IMAP *imap = conn->data->req.protop;
   struct imap_conn *imapc = &conn->proto.imapc;
   const char *line = data->state.buffer;
-  char tmp[20];
 
   (void)instate; /* no use for this yet */
 
   if(imapcode == '*') {
     /* See if this is an UIDVALIDITY response */
+    char tmp[20];
     if(sscanf(line + 2, "OK [UIDVALIDITY %19[0123456789]]", tmp) == 1) {
       Curl_safefree(imapc->mailbox_uidvalidity);
       imapc->mailbox_uidvalidity = strdup(tmp);
@@ -1119,7 +1119,7 @@ static CURLcode imap_state_fetch_resp(struct connectdata 
*conn, int imapcode,
   }
 
   if(parsed) {
-    infof(data, "Found %" CURL_FORMAT_CURL_OFF_TU " bytes to download\n",
+    infof(data, "Found %" CURL_FORMAT_CURL_OFF_T " bytes to download\n",
           size);
     Curl_pgrsSetDownloadSize(data, size);
 
@@ -1144,10 +1144,8 @@ static CURLcode imap_state_fetch_resp(struct connectdata 
*conn, int imapcode,
 
       data->req.bytecount += chunk;
 
-      infof(data, "Written %" CURL_FORMAT_CURL_OFF_TU
-            " bytes, %" CURL_FORMAT_CURL_OFF_TU
-            " bytes are left for transfer\n", (curl_off_t)chunk,
-            size - chunk);
+      infof(data, "Written %zu bytes, %" CURL_FORMAT_CURL_OFF_TU
+            " bytes are left for transfer\n", chunk, size - chunk);
 
       /* Have we used the entire cache or just part of it?*/
       if(pp->cache_size > chunk) {
diff --git a/lib/inet_ntop.c b/lib/inet_ntop.c
index fb91a505d..ac5d2d4d6 100644
--- a/lib/inet_ntop.c
+++ b/lib/inet_ntop.c
@@ -49,7 +49,7 @@
  */
 static char *inet_ntop4 (const unsigned char *src, char *dst, size_t size)
 {
-  char tmp[sizeof "255.255.255.255"];
+  char tmp[sizeof("255.255.255.255")];
   size_t len;
 
   DEBUGASSERT(size >= 16);
diff --git a/lib/ldap.c b/lib/ldap.c
index 7f4f4dd76..79af14acd 100644
--- a/lib/ldap.c
+++ b/lib/ldap.c
@@ -54,15 +54,6 @@
 # endif /* HAVE_LDAP_SSL && HAVE_LDAP_SSL_H */
 #endif
 
-/* These are macros in both <wincrypt.h> (in above <winldap.h>) and typedefs
- * in BoringSSL's <openssl/x509.h>
- */
-#ifdef HAVE_BORINGSSL
-# undef X509_NAME
-# undef X509_CERT_PAIR
-# undef X509_EXTENSIONS
-#endif
-
 #include "urldata.h"
 #include <gnurl/curl.h>
 #include "sendf.h"
diff --git a/lib/md5.c b/lib/md5.c
index ef53f59bb..d408a2aef 100644
--- a/lib/md5.c
+++ b/lib/md5.c
@@ -527,7 +527,7 @@ MD5_context *Curl_MD5_init(const MD5_params *md5params)
   MD5_context *ctxt;
 
   /* Create MD5 context */
-  ctxt = malloc(sizeof *ctxt);
+  ctxt = malloc(sizeof(*ctxt));
 
   if(!ctxt)
     return ctxt;
diff --git a/lib/memdebug.h b/lib/memdebug.h
index 6fb8b6851..233de65a4 100644
--- a/lib/memdebug.h
+++ b/lib/memdebug.h
@@ -8,7 +8,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+ * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -137,13 +137,6 @@ CURL_EXTERN int curl_fclose(FILE *file, int line, const 
char *source);
 #endif
 #endif /* HAVE_GETADDRINFO */
 
-#ifdef HAVE_GETNAMEINFO
-#undef getnameinfo
-#define getnameinfo(sa,salen,host,hostlen,serv,servlen,flags) \
-  curl_dogetnameinfo(sa, salen, host, hostlen, serv, servlen, flags, \
-                     __LINE__, __FILE__)
-#endif /* HAVE_GETNAMEINFO */
-
 #ifdef HAVE_FREEADDRINFO
 #undef freeaddrinfo
 #define freeaddrinfo(data) \
diff --git a/lib/mime.c b/lib/mime.c
index cbb4a2ce5..ca77649aa 100644
--- a/lib/mime.c
+++ b/lib/mime.c
@@ -505,9 +505,6 @@ static size_t encoder_qp_read(char *buffer, size_t size, 
bool ateof,
   mime_encoder_state *st = &part->encstate;
   char *ptr = buffer;
   size_t cursize = 0;
-  int i;
-  size_t len;
-  size_t consumed;
   int softlinebreak;
   char buf[4];
 
@@ -516,9 +513,9 @@ static size_t encoder_qp_read(char *buffer, size_t size, 
bool ateof,
      character constants that can be interpreted as non-ascii on some
      platforms. Preserve ASCII encoding on output too. */
   while(st->bufbeg < st->bufend) {
-    len = 1;
-    consumed = 1;
-    i = st->buf[st->bufbeg];
+    size_t len = 1;
+    size_t consumed = 1;
+    int i = st->buf[st->bufbeg];
     buf[0] = (char) i;
     buf[1] = aschex[(i >> 4) & 0xF];
     buf[2] = aschex[i & 0xF];
@@ -787,10 +784,10 @@ static size_t read_encoded_part_content(curl_mimepart 
*part,
       st->bufbeg = 0;
       st->bufend = len;
     }
-    if(st->bufend >= sizeof st->buf)
+    if(st->bufend >= sizeof(st->buf))
       return cursize? cursize: READ_ERROR;    /* Buffer full. */
     sz = read_part_content(part, st->buf + st->bufend,
-                           sizeof st->buf - st->bufend);
+                           sizeof(st->buf) - st->bufend);
     switch(sz) {
     case 0:
       ateof = TRUE;
@@ -813,8 +810,6 @@ static size_t readback_part(curl_mimepart *part,
                             char *buffer, size_t bufsize)
 {
   size_t cursize = 0;
-  size_t sz;
-  struct curl_slist *hdr;
 #ifdef CURL_DOES_CONVERSIONS
   char *convbuf = buffer;
 #endif
@@ -822,8 +817,8 @@ static size_t readback_part(curl_mimepart *part,
   /* Readback from part. */
 
   while(bufsize) {
-    sz = 0;
-    hdr = (struct curl_slist *) part->state.ptr;
+    size_t sz = 0;
+    struct curl_slist *hdr = (struct curl_slist *) part->state.ptr;
     switch(part->state.state) {
     case MIMESTATE_BEGIN:
       mimesetstate(&part->state, part->flags & MIME_BODY_ONLY? MIMESTATE_BODY:
@@ -918,8 +913,6 @@ static size_t mime_subparts_read(char *buffer, size_t size, 
size_t nitems,
 {
   curl_mime *mime = (curl_mime *) instream;
   size_t cursize = 0;
-  size_t sz;
-  curl_mimepart *part;
 #ifdef CURL_DOES_CONVERSIONS
   char *convbuf = buffer;
 #endif
@@ -927,8 +920,8 @@ static size_t mime_subparts_read(char *buffer, size_t size, 
size_t nitems,
   (void) size;   /* Always 1. */
 
   while(nitems) {
-    sz = 0;
-    part = mime->state.ptr;
+    size_t sz = 0;
+    curl_mimepart *part = mime->state.ptr;
     switch(mime->state.state) {
     case MIMESTATE_BEGIN:
     case MIMESTATE_BODY:
@@ -1044,7 +1037,6 @@ static int mime_subparts_seek(void *instream, curl_off_t 
offset, int whence)
   curl_mime *mime = (curl_mime *) instream;
   curl_mimepart *part;
   int result = CURL_SEEKFUNC_OK;
-  int res;
 
   if(whence != SEEK_SET || offset)
     return CURL_SEEKFUNC_CANTSEEK;    /* Only support full rewind. */
@@ -1053,7 +1045,7 @@ static int mime_subparts_seek(void *instream, curl_off_t 
offset, int whence)
    return CURL_SEEKFUNC_OK;           /* Already rewound. */
 
   for(part = mime->firstpart; part; part = part->nextpart) {
-    res = mime_part_rewind(part);
+    int res = mime_part_rewind(part);
     if(res != CURL_SEEKFUNC_OK)
       result = res;
   }
@@ -1220,7 +1212,7 @@ curl_mime *curl_mime_init(struct Curl_easy *easy)
 {
   curl_mime *mime;
 
-  mime = (curl_mime *) malloc(sizeof *mime);
+  mime = (curl_mime *) malloc(sizeof(*mime));
 
   if(mime) {
     mime->easy = easy;
@@ -1247,7 +1239,7 @@ curl_mime *curl_mime_init(struct Curl_easy *easy)
 /* Initialize a mime part. */
 void Curl_mime_initpart(curl_mimepart *part, struct Curl_easy *easy)
 {
-  memset((char *) part, 0, sizeof *part);
+  memset((char *) part, 0, sizeof(*part));
   part->easy = easy;
   mimesetstate(&part->state, MIMESTATE_BEGIN, NULL);
 }
@@ -1260,7 +1252,7 @@ curl_mimepart *curl_mime_addpart(curl_mime *mime)
   if(!mime)
     return NULL;
 
-  part = (curl_mimepart *) malloc(sizeof *part);
+  part = (curl_mimepart *) malloc(sizeof(*part));
 
   if(part) {
     Curl_mime_initpart(part, mime->easy);
@@ -1349,7 +1341,6 @@ CURLcode curl_mime_data(curl_mimepart *part,
 CURLcode curl_mime_filedata(curl_mimepart *part, const char *filename)
 {
   CURLcode result = CURLE_OK;
-  char *base;
 
   if(!part)
     return CURLE_BAD_FUNCTION_ARGUMENT;
@@ -1357,6 +1348,7 @@ CURLcode curl_mime_filedata(curl_mimepart *part, const 
char *filename)
   cleanup_part_content(part);
 
   if(filename) {
+    char *base;
     struct_stat sbuf;
 
     if(stat(filename, &sbuf) || access(filename, R_OK))
@@ -1564,7 +1556,6 @@ static size_t slist_size(struct curl_slist *s,
 static curl_off_t multipart_size(curl_mime *mime)
 {
   curl_off_t size;
-  curl_off_t sz;
   size_t boundarysize;
   curl_mimepart *part;
 
@@ -1575,7 +1566,7 @@ static curl_off_t multipart_size(curl_mime *mime)
   size = boundarysize;  /* Final boundary - CRLF after headers. */
 
   for(part = mime->firstpart; part; part = part->nextpart) {
-    sz = Curl_mime_size(part);
+    curl_off_t sz = Curl_mime_size(part);
 
     if(sz < 0)
       size = sz;
@@ -1643,8 +1634,6 @@ static CURLcode add_content_type(struct curl_slist **slp,
 
 const char *Curl_mime_contenttype(const char *filename)
 {
-  unsigned int i;
-
   /*
    * If no content type was specified, we scan through a few well-known
    * extensions and pick the first we match!
@@ -1669,8 +1658,9 @@ const char *Curl_mime_contenttype(const char *filename)
   if(filename) {
     size_t len1 = strlen(filename);
     const char *nameend = filename + len1;
+    unsigned int i;
 
-    for(i = 0; i < sizeof ctts / sizeof ctts[0]; i++) {
+    for(i = 0; i < sizeof(ctts) / sizeof(ctts[0]); i++) {
       size_t len2 = strlen(ctts[i].extension);
 
       if(len1 >= len2 && strcasecompare(nameend - len2, ctts[i].extension))
diff --git a/lib/mk-ca-bundle.pl b/lib/mk-ca-bundle.pl
index 5a84f6b0b..33977f322 100755
--- a/lib/mk-ca-bundle.pl
+++ b/lib/mk-ca-bundle.pl
@@ -136,6 +136,7 @@ if ($opt_i) {
   print "Perl Version                     : $]\n";
   print "Operating System Name            : $^O\n";
   print "Getopt::Std.pm Version           : ${Getopt::Std::VERSION}\n";
+  print "Encode::Encoding.pm Version      : ${Encode::Encoding::VERSION}\n";
   print "MIME::Base64.pm Version          : ${MIME::Base64::VERSION}\n";
   print "LWP::UserAgent.pm Version        : ${LWP::UserAgent::VERSION}\n" 
if($LWP::UserAgent::VERSION);
   print "LWP.pm Version                   : ${LWP::VERSION}\n" 
if($LWP::VERSION);
@@ -376,6 +377,9 @@ my $newhash= sha256($txt);
 
 if(!$opt_f && $oldhash eq $newhash) {
     report "Downloaded file identical to previous run\'s source file. Exiting";
+    if($opt_u && -e $txt && !unlink($txt)) {
+        report "Failed to remove $txt: $!\n";
+    }
     exit;
 }
 
@@ -479,6 +483,7 @@ while (<TXT>) {
 
     if ( !should_output_cert(%trust_purposes_by_level) ) {
       $skipnum ++;
+      report "Skipping: $caname" if ($opt_v);
     } else {
       my $encoded = MIME::Base64::encode_base64($data, '');
       $encoded =~ s/(.{1,${opt_w}})/$1\n/g;
@@ -487,7 +492,7 @@ while (<TXT>) {
               . "-----END CERTIFICATE-----\n";
       print CRT "\n$caname\n";
       print CRT @precert if($opt_m);
-      my $maxStringLength = length(decode('UTF-8', $caname, Encode::FB_CROAK));
+      my $maxStringLength = length(decode('UTF-8', $caname, Encode::FB_CROAK | 
Encode::LEAVE_SRC));
       if ($opt_t) {
         foreach my $key (keys %trust_purposes_by_level) {
            my $string = $key . ": " . join(", ", 
@{$trust_purposes_by_level{$key}});
diff --git a/lib/multi.c b/lib/multi.c
index bf68f18f7..d340ed373 100644
--- a/lib/multi.c
+++ b/lib/multi.c
@@ -31,6 +31,7 @@
 #include "progress.h"
 #include "easyif.h"
 #include "share.h"
+#include "psl.h"
 #include "multiif.h"
 #include "sendf.h"
 #include "timeval.h"
@@ -68,8 +69,8 @@
 #define GOOD_MULTI_HANDLE(x) \
   ((x) && (x)->type == CURL_MULTI_HANDLE)
 
-static void singlesocket(struct Curl_multi *multi,
-                         struct Curl_easy *data);
+static CURLMcode singlesocket(struct Curl_multi *multi,
+                              struct Curl_easy *data);
 static int update_timer(struct Curl_multi *multi);
 
 static CURLMcode add_next_timeout(struct curltime now,
@@ -409,6 +410,14 @@ CURLMcode curl_multi_add_handle(struct Curl_multi *multi,
   else
     data->state.conn_cache = &multi->conn_cache;
 
+#ifdef USE_LIBPSL
+  /* Do the same for PSL. */
+  if(data->share && (data->share->specifier & (1 << CURL_LOCK_DATA_PSL)))
+    data->psl = &data->share->psl;
+  else
+    data->psl = &multi->psl;
+#endif
+
   /* This adds the new entry at the 'end' of the doubly-linked circular
      list of Curl_easy structs to try and maintain a FIFO queue so
      the pipelined requests are in order. */
@@ -449,7 +458,7 @@ CURLMcode curl_multi_add_handle(struct Curl_multi *multi,
      happens if the lastcall time is set to the same time when the handle is
      removed as when the next handle is added, as then the check in
      update_timer() that prevents calling the application multiple times with
-     the same timer infor will not trigger and then the new handle's timeout
+     the same timer info will not trigger and then the new handle's timeout
      will not be notified to the app.
 
      The work-around is thus simply to clear the 'lastcall' variable to force
@@ -506,6 +515,11 @@ static CURLcode multi_done(struct connectdata **connp,
     /* Stop if multi_done() has already been called */
     return CURLE_OK;
 
+  if(data->mstate == CURLM_STATE_WAITRESOLVE) {
+    /* still waiting for the resolve to complete */
+    (void)Curl_resolver_wait_resolv(conn, NULL);
+  }
+
   Curl_getoff_all_pipelines(data, conn);
 
   /* Cleanup possible redirect junk */
@@ -546,7 +560,7 @@ static CURLcode multi_done(struct connectdata **connp,
   if(conn->send_pipe.size || conn->recv_pipe.size) {
     /* Stop if pipeline is not empty . */
     data->easy_conn = NULL;
-    DEBUGF(infof(data, "Connection still in use %d/%d, "
+    DEBUGF(infof(data, "Connection still in use %zu/%zu, "
                  "no more multi_done now!\n",
                  conn->send_pipe.size, conn->recv_pipe.size));
     return CURLE_OK;
@@ -698,6 +712,11 @@ CURLMcode curl_multi_remove_handle(struct Curl_multi 
*multi,
       Curl_getoff_all_pipelines(data, data->easy_conn);
   }
 
+  if(data->connect_queue.ptr)
+    /* the handle was in the pending list waiting for an available connection,
+       so go ahead and remove it */
+    Curl_llist_remove(&multi->pending, &data->connect_queue, NULL);
+
   if(data->dns.hostcachetype == HCACHE_MULTI) {
     /* stop using the multi handle's DNS cache, *after* the possible
        multi_done() call above */
@@ -727,6 +746,12 @@ CURLMcode curl_multi_remove_handle(struct Curl_multi 
*multi,
     data->easy_conn = NULL;
   }
 
+#ifdef USE_LIBPSL
+  /* Remove the PSL association. */
+  if(data->psl == &multi->psl)
+    data->psl = NULL;
+#endif
+
   data->multi = NULL; /* clear the association to this multi handle */
 
   /* make sure there's no pending message in the queue sent from this easy
@@ -902,7 +927,6 @@ CURLMcode curl_multi_fdset(struct Curl_multi *multi,
   struct Curl_easy *data;
   int this_max_fd = -1;
   curl_socket_t sockbunch[MAX_SOCKSPEREASYHANDLE];
-  int bitmap;
   int i;
   (void)exc_fd_set; /* not used */
 
@@ -914,7 +938,7 @@ CURLMcode curl_multi_fdset(struct Curl_multi *multi,
 
   data = multi->easyp;
   while(data) {
-    bitmap = multi_getsock(data, sockbunch, MAX_SOCKSPEREASYHANDLE);
+    int bitmap = multi_getsock(data, sockbunch, MAX_SOCKSPEREASYHANDLE);
 
     for(i = 0; i< MAX_SOCKSPEREASYHANDLE; i++) {
       curl_socket_t s = CURL_SOCKET_BAD;
@@ -1068,8 +1092,6 @@ CURLMcode curl_multi_wait(struct Curl_multi *multi,
     int pollrc;
     /* wait... */
     pollrc = Curl_poll(ufds, nfds, timeout_ms);
-    DEBUGF(infof(data, "Curl_poll(%d ds, %d ms) == %d\n",
-                 nfds, timeout_ms, pollrc));
 
     if(pollrc > 0) {
       retcode = pollrc;
@@ -2220,6 +2242,11 @@ CURLMcode curl_multi_cleanup(struct Curl_multi *multi)
       data->state.conn_cache = NULL;
       data->multi = NULL; /* clear the association */
 
+#ifdef USE_LIBPSL
+      if(data->psl == &multi->psl)
+        data->psl = NULL;
+#endif
+
       data = nextdata;
     }
 
@@ -2232,6 +2259,7 @@ CURLMcode curl_multi_cleanup(struct Curl_multi *multi)
     Curl_llist_destroy(&multi->pending, NULL);
 
     Curl_hash_destroy(&multi->hostcache);
+    Curl_psl_destroy(&multi->psl);
 
     /* Free the blacklists by setting them to NULL */
     Curl_pipeline_set_site_blacklist(NULL, &multi->pipelining_site_bl);
@@ -2286,8 +2314,8 @@ CURLMsg *curl_multi_info_read(struct Curl_multi *multi, 
int *msgs_in_queue)
  * and if we have a different state in any of those sockets from last time we
  * call the callback accordingly.
  */
-static void singlesocket(struct Curl_multi *multi,
-                         struct Curl_easy *data)
+static CURLMcode singlesocket(struct Curl_multi *multi,
+                              struct Curl_easy *data)
 {
   curl_socket_t socks[MAX_SOCKSPEREASYHANDLE];
   int i;
@@ -2334,7 +2362,7 @@ static void singlesocket(struct Curl_multi *multi,
       entry = sh_addentry(&multi->sockhash, s, data);
       if(!entry)
         /* fatal */
-        return;
+        return CURLM_OUT_OF_MEMORY;
     }
 
     /* we know (entry != NULL) at this point, see the logic above */
@@ -2422,6 +2450,7 @@ static void singlesocket(struct Curl_multi *multi,
 
   memcpy(data->sockets, socks, num*sizeof(curl_socket_t));
   data->numsocks = num;
+  return CURLM_OK;
 }
 
 void Curl_updatesocket(struct Curl_easy *data)
@@ -2535,8 +2564,8 @@ static CURLMcode multi_socket(struct Curl_multi *multi,
        and callbacks */
     if(result != CURLM_BAD_HANDLE) {
       data = multi->easyp;
-      while(data) {
-        singlesocket(multi, data);
+      while(data && !result) {
+        result = singlesocket(multi, data);
         data = data->next;
       }
     }
@@ -2590,10 +2619,13 @@ static CURLMcode multi_socket(struct Curl_multi *multi,
         /* clear the bitmask only if not locked */
         data->easy_conn->cselect_bits = 0;
 
-      if(CURLM_OK >= result)
+      if(CURLM_OK >= result) {
         /* get the socket(s) and check if the state has been changed since
            last */
-        singlesocket(multi, data);
+        result = singlesocket(multi, data);
+        if(result)
+          return result;
+      }
 
       /* Now we fall-through and do the timer-based stuff, since we don't want
          to force the user to have to deal with timeouts as long as at least
@@ -2627,10 +2659,13 @@ static CURLMcode multi_socket(struct Curl_multi *multi,
       result = multi_runsingle(multi, now, data);
       sigpipe_restore(&pipe_st);
 
-      if(CURLM_OK >= result)
+      if(CURLM_OK >= result) {
         /* get the socket(s) and check if the state has been changed since
            last */
-        singlesocket(multi, data);
+        result = singlesocket(multi, data);
+        if(result)
+          return result;
+      }
     }
 
     /* Check if there's one (more) expired timer to deal with! This function
@@ -2924,7 +2959,6 @@ void Curl_expire(struct Curl_easy *data, time_t milli, 
expire_id id)
 {
   struct Curl_multi *multi = data->multi;
   struct curltime *nowp = &data->state.expiretime;
-  int rc;
   struct curltime set;
 
   /* this is only interesting while there is still an associated multi struct
@@ -2955,6 +2989,7 @@ void Curl_expire(struct Curl_easy *data, time_t milli, 
expire_id id)
        Compare if the new time is earlier, and only remove-old/add-new if it
        is. */
     timediff_t diff = Curl_timediff(set, *nowp);
+    int rc;
 
     if(diff > 0) {
       /* The current splay tree entry is sooner than this new expiry time.
@@ -3000,7 +3035,6 @@ void Curl_expire_clear(struct Curl_easy *data)
 {
   struct Curl_multi *multi = data->multi;
   struct curltime *nowp = &data->state.expiretime;
-  int rc;
 
   /* this is only interesting while there is still an associated multi struct
      remaining! */
@@ -3011,6 +3045,7 @@ void Curl_expire_clear(struct Curl_easy *data)
     /* Since this is an cleared time, we must remove the previous entry from
        the splay tree */
     struct curl_llist *list = &data->state.timeoutlist;
+    int rc;
 
     rc = Curl_splayremovebyaddr(multi->timetree,
                                 &data->state.timenode,
diff --git a/lib/multihandle.h b/lib/multihandle.h
index 1a5017f4a..ea2bf352d 100644
--- a/lib/multihandle.h
+++ b/lib/multihandle.h
@@ -7,7 +7,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+ * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -23,6 +23,7 @@
  ***************************************************************************/
 
 #include "conncache.h"
+#include "psl.h"
 
 struct Curl_message {
   struct curl_llist_element list;
@@ -97,6 +98,11 @@ struct Curl_multi {
   /* Hostname cache */
   struct curl_hash hostcache;
 
+#ifdef USE_LIBPSL
+  /* PSL cache. */
+  struct PslCache psl;
+#endif
+
   /* timetree points to the splay-tree of time nodes to figure out expire
      times of all currently set timers */
   struct Curl_tree *timetree;
diff --git a/lib/netrc.c b/lib/netrc.c
index 084908ac7..948c41517 100644
--- a/lib/netrc.c
+++ b/lib/netrc.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+ * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -115,7 +115,7 @@ int Curl_parsenetrc(const char *host,
     char *tok;
     char *tok_buf;
     bool done = FALSE;
-    char netrcbuffer[256];
+    char netrcbuffer[4096];
     int  netrcbuffsize = (int)sizeof(netrcbuffer);
 
     while(!done && fgets(netrcbuffer, netrcbuffsize, file)) {
diff --git a/lib/pingpong.c b/lib/pingpong.c
index ad370ee82..2e93d201f 100644
--- a/lib/pingpong.c
+++ b/lib/pingpong.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+ * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -49,7 +49,6 @@ time_t Curl_pp_state_timeout(struct pingpong *pp)
   struct connectdata *conn = pp->conn;
   struct Curl_easy *data = conn->data;
   time_t timeout_ms; /* in milliseconds */
-  time_t timeout2_ms; /* in milliseconds */
   long response_time = (data->set.server_response_timeout)?
     data->set.server_response_timeout: pp->response_time;
 
@@ -65,7 +64,7 @@ time_t Curl_pp_state_timeout(struct pingpong *pp)
 
   if(data->set.timeout) {
     /* if timeout is requested, find out how much remaining time we have */
-    timeout2_ms = data->set.timeout - /* timeout time */
+    time_t timeout2_ms = data->set.timeout - /* timeout time */
       Curl_timediff(Curl_now(), conn->now); /* spent time */
 
     /* pick the lowest number */
@@ -222,8 +221,7 @@ CURLcode Curl_pp_vsendf(struct pingpong *pp,
   }
 
   if(conn->data->set.verbose)
-    Curl_debug(conn->data, CURLINFO_HEADER_OUT,
-               s, (size_t)bytes_written, conn);
+    Curl_debug(conn->data, CURLINFO_HEADER_OUT, s, (size_t)bytes_written);
 
   if(bytes_written != (ssize_t)write_len) {
     /* the whole chunk was not sent, keep it around and adjust sizes */
@@ -371,7 +369,7 @@ CURLcode Curl_pp_readresp(curl_socket_t sockfd,
 #endif
             if(data->set.verbose)
               Curl_debug(data, CURLINFO_HEADER_IN,
-                         pp->linestart_resp, (size_t)perline, conn);
+                         pp->linestart_resp, (size_t)perline);
 
           /*
            * We pass all response-lines to the callback function registered
diff --git a/lib/pipeline.c b/lib/pipeline.c
index c0917c79f..d16b13cdf 100644
--- a/lib/pipeline.c
+++ b/lib/pipeline.c
@@ -82,7 +82,8 @@ bool Curl_pipeline_penalized(struct Curl_easy *data,
       penalized = TRUE;
 
     infof(data, "Conn: %ld (%p) Receive pipe weight: (%"
-          CURL_FORMAT_CURL_OFF_T "/%zu), penalized: %s\n",
+          CURL_FORMAT_CURL_OFF_T "/%" CURL_FORMAT_CURL_OFF_T
+          "), penalized: %s\n",
           conn->connection_id, (void *)conn, recv_size,
           conn->chunk.datasize, penalized?"TRUE":"FALSE");
     return penalized;
diff --git a/lib/pop3.c b/lib/pop3.c
index 5d0d3c06a..d1481b34a 100644
--- a/lib/pop3.c
+++ b/lib/pop3.c
@@ -613,7 +613,6 @@ static CURLcode pop3_state_servergreet_resp(struct 
connectdata *conn,
   struct pop3_conn *pop3c = &conn->proto.pop3c;
   const char *line = data->state.buffer;
   size_t len = strlen(line);
-  size_t i;
 
   (void)instate; /* no use for this yet */
 
@@ -625,6 +624,7 @@ static CURLcode pop3_state_servergreet_resp(struct 
connectdata *conn,
     /* Does the server support APOP authentication? */
     if(len >= 4 && line[len - 2] == '>') {
       /* Look for the APOP timestamp */
+      size_t i;
       for(i = 3; i < len - 2; ++i) {
         if(line[i] == '<') {
           /* Calculate the length of the timestamp */
@@ -664,7 +664,6 @@ static CURLcode pop3_state_capa_resp(struct connectdata 
*conn, int pop3code,
   struct pop3_conn *pop3c = &conn->proto.pop3c;
   const char *line = data->state.buffer;
   size_t len = strlen(line);
-  size_t wordlen;
 
   (void)instate; /* no use for this yet */
 
@@ -689,6 +688,7 @@ static CURLcode pop3_state_capa_resp(struct connectdata 
*conn, int pop3code,
       /* Loop through the data line */
       for(;;) {
         size_t llen;
+        size_t wordlen;
         unsigned int mechbit;
 
         while(len &&
diff --git a/lib/progress.c b/lib/progress.c
index f59faa3d3..a94668dc2 100644
--- a/lib/progress.c
+++ b/lib/progress.c
@@ -35,22 +35,22 @@
    byte) */
 static void time2str(char *r, curl_off_t seconds)
 {
-  curl_off_t d, h, m, s;
+  curl_off_t h;
   if(seconds <= 0) {
     strcpy(r, "--:--:--");
     return;
   }
   h = seconds / CURL_OFF_T_C(3600);
   if(h <= CURL_OFF_T_C(99)) {
-    m = (seconds - (h*CURL_OFF_T_C(3600))) / CURL_OFF_T_C(60);
-    s = (seconds - (h*CURL_OFF_T_C(3600))) - (m*CURL_OFF_T_C(60));
+    curl_off_t m = (seconds - (h*CURL_OFF_T_C(3600))) / CURL_OFF_T_C(60);
+    curl_off_t s = (seconds - (h*CURL_OFF_T_C(3600))) - (m*CURL_OFF_T_C(60));
     snprintf(r, 9, "%2" CURL_FORMAT_CURL_OFF_T ":%02" CURL_FORMAT_CURL_OFF_T
              ":%02" CURL_FORMAT_CURL_OFF_T, h, m, s);
   }
   else {
     /* this equals to more than 99 hours, switch to a more suitable output
        format to fit within the limits. */
-    d = seconds / CURL_OFF_T_C(86400);
+    curl_off_t d = seconds / CURL_OFF_T_C(86400);
     h = (seconds - (d*CURL_OFF_T_C(86400))) / CURL_OFF_T_C(3600);
     if(d <= CURL_OFF_T_C(999))
       snprintf(r, 9, "%3" CURL_FORMAT_CURL_OFF_T
@@ -369,25 +369,10 @@ void Curl_pgrsSetUploadSize(struct Curl_easy *data, 
curl_off_t size)
 int Curl_pgrsUpdate(struct connectdata *conn)
 {
   struct curltime now;
-  int result;
-  char max5[6][10];
-  curl_off_t dlpercen = 0;
-  curl_off_t ulpercen = 0;
-  curl_off_t total_percen = 0;
-  curl_off_t total_transfer;
-  curl_off_t total_expected_transfer;
   curl_off_t timespent;
   curl_off_t timespent_ms; /* milliseconds */
   struct Curl_easy *data = conn->data;
   int nowindex = data->progress.speeder_c% CURR_TIME;
-  int checkindex;
-  int countindex; /* amount of seconds stored in the speeder array */
-  char time_left[10];
-  char time_total[10];
-  char time_spent[10];
-  curl_off_t ulestimate = 0;
-  curl_off_t dlestimate = 0;
-  curl_off_t total_estimate;
   bool shownow = FALSE;
   curl_off_t dl = data->progress.downloaded;
   curl_off_t ul = data->progress.uploaded;
@@ -413,6 +398,7 @@ int Curl_pgrsUpdate(struct connectdata *conn)
 
   /* Calculations done at most once a second, unless end is reached */
   if(data->progress.lastshow != now.tv_sec) {
+    int countindex; /* amount of seconds stored in the speeder array */
     shownow = TRUE;
 
     data->progress.lastshow = now.tv_sec;
@@ -438,6 +424,7 @@ int Curl_pgrsUpdate(struct connectdata *conn)
 
     /* first of all, we don't do this if there's no counted seconds yet */
     if(countindex) {
+      int checkindex;
       timediff_t span_ms;
 
       /* Get the index position to compare with the 'nowindex' position.
@@ -477,8 +464,21 @@ int Curl_pgrsUpdate(struct connectdata *conn)
 
   if(!(data->progress.flags & PGRS_HIDE)) {
     /* progress meter has not been shut off */
+    char max5[6][10];
+    curl_off_t dlpercen = 0;
+    curl_off_t ulpercen = 0;
+    curl_off_t total_percen = 0;
+    curl_off_t total_transfer;
+    curl_off_t total_expected_transfer;
+    char time_left[10];
+    char time_total[10];
+    char time_spent[10];
+    curl_off_t ulestimate = 0;
+    curl_off_t dlestimate = 0;
+    curl_off_t total_estimate;
 
     if(data->set.fxferinfo) {
+      int result;
       /* There's a callback set, call that */
       Curl_set_in_callback(data, true);
       result = data->set.fxferinfo(data->set.progress_client,
@@ -492,6 +492,7 @@ int Curl_pgrsUpdate(struct connectdata *conn)
       return result;
     }
     if(data->set.fprogress) {
+      int result;
       /* The older deprecated callback is set, call that */
       Curl_set_in_callback(data, true);
       result = data->set.fprogress(data->set.progress_client,
diff --git a/lib/progress.h b/lib/progress.h
index 2baa925db..92dbcbd9a 100644
--- a/lib/progress.h
+++ b/lib/progress.h
@@ -56,23 +56,10 @@ timediff_t Curl_pgrsLimitWaitTime(curl_off_t cursize,
                                   struct curltime start,
                                   struct curltime now);
 
-/* Don't show progress for sizes smaller than: */
-#define LEAST_SIZE_PROGRESS BUFSIZE
-
-#define PROGRESS_DOWNLOAD (1<<0)
-#define PROGRESS_UPLOAD   (1<<1)
-#define PROGRESS_DOWN_AND_UP (PROGRESS_UPLOAD | PROGRESS_DOWNLOAD)
-
-#define PGRS_SHOW_DL (1<<0)
-#define PGRS_SHOW_UL (1<<1)
-#define PGRS_DONE_DL (1<<2)
-#define PGRS_DONE_UL (1<<3)
 #define PGRS_HIDE    (1<<4)
 #define PGRS_UL_SIZE_KNOWN (1<<5)
 #define PGRS_DL_SIZE_KNOWN (1<<6)
-
 #define PGRS_HEADERS_OUT (1<<7) /* set when the headers have been written */
 
-
 #endif /* HEADER_CURL_PROGRESS_H */
 
diff --git a/lib/psl.c b/lib/psl.c
new file mode 100644
index 000000000..d50c6250f
--- /dev/null
+++ b/lib/psl.c
@@ -0,0 +1,111 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.haxx.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ ***************************************************************************/
+
+#include "curl_setup.h"
+
+#include <gnurl/curl.h>
+
+#ifdef USE_LIBPSL
+
+#include "psl.h"
+#include "share.h"
+
+/* The last 3 #include files should be in this order */
+#include "curl_printf.h"
+#include "curl_memory.h"
+#include "memdebug.h"
+
+void Curl_psl_destroy(struct PslCache *pslcache)
+{
+  if(pslcache->psl) {
+    if(pslcache->dynamic)
+      psl_free((psl_ctx_t *) pslcache->psl);
+    pslcache->psl = NULL;
+    pslcache->dynamic = FALSE;
+  }
+}
+
+static time_t now_seconds(void)
+{
+  struct curltime now = Curl_now();
+
+  return now.tv_sec;
+}
+
+const psl_ctx_t *Curl_psl_use(struct Curl_easy *easy)
+{
+  struct PslCache *pslcache = easy->psl;
+  const psl_ctx_t *psl;
+  time_t now;
+
+  if(!pslcache)
+    return NULL;
+
+  Curl_share_lock(easy, CURL_LOCK_DATA_PSL, CURL_LOCK_ACCESS_SHARED);
+  now = now_seconds();
+  if(!pslcache->psl || pslcache->expires <= now) {
+    /* Let a chance to other threads to do the job: avoids deadlock. */
+    Curl_share_unlock(easy, CURL_LOCK_DATA_PSL);
+
+    /* Update cache: this needs an exclusive lock. */
+    Curl_share_lock(easy, CURL_LOCK_DATA_PSL, CURL_LOCK_ACCESS_SINGLE);
+
+    /* Recheck in case another thread did the job. */
+    now = now_seconds();
+    if(!pslcache->psl || pslcache->expires <= now) {
+      bool dynamic = FALSE;
+      time_t expires = TIME_T_MAX;
+
+#if defined(PSL_VERSION_NUMBER) && PSL_VERSION_NUMBER >= 0x001000
+      psl = psl_latest(NULL);
+      dynamic = psl != NULL;
+      /* Take care of possible time computation overflow. */
+      expires = now < TIME_T_MAX - PSL_TTL? now + PSL_TTL: TIME_T_MAX;
+
+      /* Only get the built-in PSL if we do not already have the "latest". */
+      if(!psl && !pslcache->dynamic)
+#endif
+
+        psl = psl_builtin();
+
+      if(psl) {
+        Curl_psl_destroy(pslcache);
+        pslcache->psl = psl;
+        pslcache->dynamic = dynamic;
+        pslcache->expires = expires;
+      }
+    }
+    Curl_share_unlock(easy, CURL_LOCK_DATA_PSL);  /* Release exclusive lock. */
+    Curl_share_lock(easy, CURL_LOCK_DATA_PSL, CURL_LOCK_ACCESS_SHARED);
+  }
+  psl = pslcache->psl;
+  if(!psl)
+    Curl_share_unlock(easy, CURL_LOCK_DATA_PSL);
+  return psl;
+}
+
+void Curl_psl_release(struct Curl_easy *easy)
+{
+  Curl_share_unlock(easy, CURL_LOCK_DATA_PSL);
+}
+
+#endif /* USE_LIBPSL */
diff --git a/src/tool_filetime.h b/lib/psl.h
similarity index 61%
copy from src/tool_filetime.h
copy to lib/psl.h
index 966a70b46..e9f99d03e 100644
--- a/src/tool_filetime.h
+++ b/lib/psl.h
@@ -1,5 +1,5 @@
-#ifndef HEADER_CURL_TOOL_FILETIME_H
-#define HEADER_CURL_TOOL_FILETIME_H
+#ifndef HEADER_PSL_H
+#define HEADER_PSL_H
 /***************************************************************************
  *                                  _   _ ____  _
  *  Project                     ___| | | |  _ \| |
@@ -21,18 +21,27 @@
  * KIND, either express or implied.
  *
  ***************************************************************************/
-#include "tool_setup.h"
 
-curl_off_t getfiletime(const char *filename, FILE *error_stream);
+#ifdef USE_LIBPSL
+#include <libpsl.h>
+
+#define PSL_TTL (72 * 3600)     /* PSL time to live before a refresh. */
+
+struct PslCache {
+  const psl_ctx_t *psl; /* The PSL. */
+  time_t expires; /* Time this PSL life expires. */
+  bool dynamic; /* PSL should be released when no longer needed. */
+};
+
+const psl_ctx_t *Curl_psl_use(struct Curl_easy *easy);
+void Curl_psl_release(struct Curl_easy *easy);
+void Curl_psl_destroy(struct PslCache *pslcache);
 
-#if defined(HAVE_UTIME) || defined(HAVE_UTIMES) || \
-    (defined(WIN32) && (SIZEOF_CURL_OFF_T >= 8))
-void setfiletime(curl_off_t filetime, const char *filename,
-    FILE *error_stream);
 #else
-#define setfiletime(a,b,c) Curl_nop_stmt
-#endif /* defined(HAVE_UTIME) || defined(HAVE_UTIMES) || \
-          (defined(WIN32) && (SIZEOF_CURL_OFF_T >= 8)) */
 
-#endif /* HEADER_CURL_TOOL_FILETIME_H */
+#define Curl_psl_use(easy) NULL
+#define Curl_psl_release(easy)
+#define Curl_psl_destroy(pslcache)
 
+#endif /* USE_LIBPSL */
+#endif /* HEADER_PSL_H */
diff --git a/lib/rand.c b/lib/rand.c
index f7af6368d..2e1abcb36 100644
--- a/lib/rand.c
+++ b/lib/rand.c
@@ -158,7 +158,7 @@ CURLcode Curl_rand_hex(struct Curl_easy *data, unsigned 
char *rnd,
   DEBUGASSERT(num > 1);
 
 #ifdef __clang_analyzer__
-  /* This silences a scan-build warning about accesssing this buffer with
+  /* This silences a scan-build warning about accessing this buffer with
      uninitialized memory. */
   memset(buffer, 0, sizeof(buffer));
 #endif
diff --git a/lib/rtsp.c b/lib/rtsp.c
index 5e64571f6..4b91b3836 100644
--- a/lib/rtsp.c
+++ b/lib/rtsp.c
@@ -218,8 +218,6 @@ static CURLcode rtsp_done(struct connectdata *conn,
   struct Curl_easy *data = conn->data;
   struct RTSP *rtsp = data->req.protop;
   CURLcode httpStatus;
-  long CSeq_sent;
-  long CSeq_recv;
 
   /* Bypass HTTP empty-reply checks on receive */
   if(data->set.rtspreq == RTSPREQ_RECEIVE)
@@ -229,8 +227,8 @@ static CURLcode rtsp_done(struct connectdata *conn,
 
   if(rtsp) {
     /* Check the sequence numbers */
-    CSeq_sent = rtsp->CSeq_sent;
-    CSeq_recv = rtsp->CSeq_recv;
+    long CSeq_sent = rtsp->CSeq_sent;
+    long CSeq_recv = rtsp->CSeq_recv;
     if((data->set.rtspreq != RTSPREQ_RECEIVE) && (CSeq_sent != CSeq_recv)) {
       failf(data,
             "The CSeq of this request %ld did not match the response %ld",
diff --git a/lib/security.c b/lib/security.c
index ac39dae09..abf242c38 100644
--- a/lib/security.c
+++ b/lib/security.c
@@ -390,7 +390,7 @@ int Curl_sec_read_msg(struct connectdata *conn, char 
*buffer,
 
   if(conn->data->set.verbose) {
     buf[decoded_len] = '\n';
-    Curl_debug(conn->data, CURLINFO_HEADER_IN, buf, decoded_len + 1, conn);
+    Curl_debug(conn->data, CURLINFO_HEADER_IN, buf, decoded_len + 1);
   }
 
   buf[decoded_len] = '\0';
@@ -488,7 +488,7 @@ static CURLcode choose_mech(struct connectdata *conn)
 
   tmp_allocation = realloc(conn->app_data, mech->size);
   if(tmp_allocation == NULL) {
-    failf(data, "Failed realloc of size %u", mech->size);
+    failf(data, "Failed realloc of size %zu", mech->size);
     mech = NULL;
     return CURLE_OUT_OF_MEMORY;
   }
diff --git a/lib/select.c b/lib/select.c
index 936cb5c6f..f7c53e7b3 100644
--- a/lib/select.c
+++ b/lib/select.c
@@ -80,7 +80,6 @@ int Curl_wait_ms(int timeout_ms)
 #endif
   struct curltime initial_tv;
   int pending_ms;
-  int error;
 #endif
   int r = 0;
 
@@ -98,6 +97,7 @@ int Curl_wait_ms(int timeout_ms)
   pending_ms = timeout_ms;
   initial_tv = Curl_now();
   do {
+    int error;
 #if defined(HAVE_POLL_FINE)
     r = poll(NULL, 0, pending_ms);
 #else
@@ -160,7 +160,6 @@ int Curl_socket_check(curl_socket_t readfd0, /* two sockets 
to read from */
 #endif
   struct curltime initial_tv = {0, 0};
   int pending_ms = 0;
-  int error;
   int r;
   int ret;
 
@@ -210,6 +209,7 @@ int Curl_socket_check(curl_socket_t readfd0, /* two sockets 
to read from */
   }
 
   do {
+    int error;
     if(timeout_ms < 0)
       pending_ms = -1;
     else if(!timeout_ms)
@@ -291,6 +291,7 @@ int Curl_socket_check(curl_socket_t readfd0, /* two sockets 
to read from */
   ptimeout = (timeout_ms < 0) ? NULL : &pending_tv;
 
   do {
+    int error;
     if(timeout_ms > 0) {
       pending_tv.tv_sec = pending_ms / 1000;
       pending_tv.tv_usec = (pending_ms % 1000) * 1000;
@@ -402,7 +403,6 @@ int Curl_poll(struct pollfd ufds[], unsigned int nfds, int 
timeout_ms)
   bool fds_none = TRUE;
   unsigned int i;
   int pending_ms = 0;
-  int error;
   int r;
 
   if(ufds) {
@@ -431,6 +431,7 @@ int Curl_poll(struct pollfd ufds[], unsigned int nfds, int 
timeout_ms)
 #ifdef HAVE_POLL_FINE
 
   do {
+    int error;
     if(timeout_ms < 0)
       pending_ms = -1;
     else if(!timeout_ms)
@@ -502,6 +503,7 @@ int Curl_poll(struct pollfd ufds[], unsigned int nfds, int 
timeout_ms)
   ptimeout = (timeout_ms < 0) ? NULL : &pending_tv;
 
   do {
+    int error;
     if(timeout_ms > 0) {
       pending_tv.tv_sec = pending_ms / 1000;
       pending_tv.tv_usec = (pending_ms % 1000) * 1000;
diff --git a/lib/sendf.c b/lib/sendf.c
index 11593b2a0..abdb5e2c7 100644
--- a/lib/sendf.c
+++ b/lib/sendf.c
@@ -240,7 +240,7 @@ void Curl_infof(struct Curl_easy *data, const char *fmt, 
...)
     vsnprintf(print_buffer, sizeof(print_buffer), fmt, ap);
     va_end(ap);
     len = strlen(print_buffer);
-    Curl_debug(data, CURLINFO_TEXT, print_buffer, len, NULL);
+    Curl_debug(data, CURLINFO_TEXT, print_buffer, len);
   }
 }
 
@@ -265,7 +265,7 @@ void Curl_failf(struct Curl_easy *data, const char *fmt, 
...)
     if(data->set.verbose) {
       error[len] = '\n';
       error[++len] = '\0';
-      Curl_debug(data, CURLINFO_TEXT, error, len, NULL);
+      Curl_debug(data, CURLINFO_TEXT, error, len);
     }
     va_end(ap);
   }
@@ -300,7 +300,7 @@ CURLcode Curl_sendf(curl_socket_t sockfd, struct 
connectdata *conn,
       break;
 
     if(data->set.verbose)
-      Curl_debug(data, CURLINFO_DATA_OUT, sptr, (size_t)bytes_written, conn);
+      Curl_debug(data, CURLINFO_DATA_OUT, sptr, (size_t)bytes_written);
 
     if((size_t)bytes_written != write_len) {
       /* if not all was written at once, we must advance the pointer, decrease
@@ -762,8 +762,8 @@ CURLcode Curl_read(struct connectdata *conn, /* connection 
data */
 }
 
 /* return 0 on success */
-static int showit(struct Curl_easy *data, curl_infotype type,
-                  char *ptr, size_t size)
+int Curl_debug(struct Curl_easy *data, curl_infotype type,
+               char *ptr, size_t size)
 {
   static const char s_infotype[CURLINFO_END][3] = {
     "* ", "< ", "> ", "{ ", "} ", "{ ", "} " };
@@ -834,41 +834,3 @@ static int showit(struct Curl_easy *data, curl_infotype 
type,
 #endif
   return rc;
 }
-
-int Curl_debug(struct Curl_easy *data, curl_infotype type,
-               char *ptr, size_t size,
-               struct connectdata *conn)
-{
-  int rc;
-  if(data->set.printhost && conn && conn->host.dispname) {
-    char buffer[160];
-    const char *t = NULL;
-    const char *w = "Data";
-    switch(type) {
-    case CURLINFO_HEADER_IN:
-      w = "Header";
-      /* FALLTHROUGH */
-    case CURLINFO_DATA_IN:
-      t = "from";
-      break;
-    case CURLINFO_HEADER_OUT:
-      w = "Header";
-      /* FALLTHROUGH */
-    case CURLINFO_DATA_OUT:
-      t = "to";
-      break;
-    default:
-      break;
-    }
-
-    if(t) {
-      snprintf(buffer, sizeof(buffer), "[%s %s %s]", w, t,
-               conn->host.dispname);
-      rc = showit(data, CURLINFO_TEXT, buffer, strlen(buffer));
-      if(rc)
-        return rc;
-    }
-  }
-  rc = showit(data, type, ptr, size);
-  return rc;
-}
diff --git a/lib/sendf.h b/lib/sendf.h
index 7c9134dec..7627fe6c5 100644
--- a/lib/sendf.h
+++ b/lib/sendf.h
@@ -84,9 +84,8 @@ CURLcode Curl_write_plain(struct connectdata *conn,
                           ssize_t *written);
 
 /* the function used to output verbose information */
-int Curl_debug(struct Curl_easy *handle, curl_infotype type,
-               char *data, size_t size,
-               struct connectdata *conn);
+int Curl_debug(struct Curl_easy *data, curl_infotype type,
+               char *ptr, size_t size);
 
 
 #endif /* HEADER_CURL_SENDF_H */
diff --git a/lib/setopt.c b/lib/setopt.c
index af53ee3ef..5ecf5b97f 100644
--- a/lib/setopt.c
+++ b/lib/setopt.c
@@ -142,6 +142,25 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption 
option,
                             va_arg(param, char *));
     break;
 
+  case CURLOPT_TLS13_CIPHERS:
+    if(Curl_ssl_tls13_ciphersuites()) {
+      /* set preferred list of TLS 1.3 cipher suites */
+      result = Curl_setstropt(&data->set.str[STRING_SSL_CIPHER13_LIST_ORIG],
+                              va_arg(param, char *));
+    }
+    else
+      return CURLE_NOT_BUILT_IN;
+    break;
+  case CURLOPT_PROXY_TLS13_CIPHERS:
+    if(Curl_ssl_tls13_ciphersuites()) {
+      /* set preferred list of TLS 1.3 cipher suites for proxy */
+      result = Curl_setstropt(&data->set.str[STRING_SSL_CIPHER13_LIST_PROXY],
+                              va_arg(param, char *));
+    }
+    else
+      return CURLE_NOT_BUILT_IN;
+    break;
+
   case CURLOPT_RANDOM_FILE:
     /*
      * This is the path name to a file that contains random data to seed
@@ -1942,6 +1961,11 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption 
option,
       if(data->share->sslsession == data->state.session)
         data->state.session = NULL;
 
+#ifdef USE_LIBPSL
+      if(data->psl == &data->share->psl)
+        data->psl = data->multi? &data->multi->psl: NULL;
+#endif
+
       data->share->dirty--;
 
       Curl_share_unlock(data, CURL_LOCK_DATA_SHARE);
@@ -1973,8 +1997,12 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption 
option,
         data->set.general_ssl.max_ssl_sessions = data->share->max_ssl_sessions;
         data->state.session = data->share->sslsession;
       }
-      Curl_share_unlock(data, CURL_LOCK_DATA_SHARE);
+#ifdef USE_LIBPSL
+      if(data->share->specifier & (1 << CURL_LOCK_DATA_PSL))
+        data->psl = &data->share->psl;
+#endif
 
+      Curl_share_unlock(data, CURL_LOCK_DATA_SHARE);
     }
     /* check for host cache not needed,
      * it will be done by curl_easy_perform */
@@ -2562,6 +2590,10 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption 
option,
   case CURLOPT_DNS_SHUFFLE_ADDRESSES:
     data->set.dns_shuffle_addresses = (0 != va_arg(param, long)) ? TRUE:FALSE;
     break;
+  case CURLOPT_DISALLOW_USERNAME_IN_URL:
+    data->set.disallow_username_in_url =
+      (0 != va_arg(param, long)) ? TRUE : FALSE;
+    break;
   default:
     /* unknown tag and its companion, just ignore: */
     result = CURLE_UNKNOWN_OPTION;
diff --git a/lib/sha256.c b/lib/sha256.c
index 55716c63b..3ac129612 100644
--- a/lib/sha256.c
+++ b/lib/sha256.c
@@ -130,8 +130,7 @@ static const unsigned long K[64] = {
 static int sha256_compress(struct sha256_state *md,
                            unsigned char *buf)
 {
-  unsigned long S[8], W[64], t0, t1;
-  unsigned long t;
+  unsigned long S[8], W[64];
   int i;
   /* copy state into S */
   for(i = 0; i < 8; i++) {
@@ -146,12 +145,13 @@ static int sha256_compress(struct sha256_state *md,
       W[i - 16];
   }
   /* Compress */
-#define RND(a,b,c,d,e,f,g,h,i)                    \
-  t0 = h + Sigma1(e) + Ch(e, f, g) + K[i] + W[i]; \
-  t1 = Sigma0(a) + Maj(a, b, c);                  \
-  d += t0;                                        \
+#define RND(a,b,c,d,e,f,g,h,i)                                  \
+  unsigned long t0 = h + Sigma1(e) + Ch(e, f, g) + K[i] + W[i]; \
+  unsigned long t1 = Sigma0(a) + Maj(a, b, c);                  \
+  d += t0;                                                      \
   h = t0 + t1;
   for(i = 0; i < 64; ++i) {
+    unsigned long t;
     RND(S[0], S[1], S[2], S[3], S[4], S[5], S[6], S[7], i);
     t = S[7]; S[7] = S[6]; S[6] = S[5]; S[5] = S[4];
     S[4] = S[3]; S[3] = S[2]; S[2] = S[1]; S[1] = S[0]; S[0] = t;
diff --git a/lib/share.c b/lib/share.c
index 8653a4300..7d51eebf1 100644
--- a/lib/share.c
+++ b/lib/share.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+ * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -25,6 +25,7 @@
 #include <gnurl/curl.h>
 #include "urldata.h"
 #include "share.h"
+#include "psl.h"
 #include "vtls/vtls.h"
 #include "curl_memory.h"
 
@@ -106,6 +107,12 @@ curl_share_setopt(struct Curl_share *share, CURLSHoption 
option, ...)
         res = CURLSHE_NOMEM;
       break;
 
+    case CURL_LOCK_DATA_PSL:
+#ifndef USE_LIBPSL
+      res = CURLSHE_NOT_BUILT_IN;
+#endif
+      break;
+
     default:
       res = CURLSHE_BAD_OPTION;
     }
@@ -205,6 +212,8 @@ curl_share_cleanup(struct Curl_share *share)
   }
 #endif
 
+  Curl_psl_destroy(&share->psl);
+
   if(share->unlockfunc)
     share->unlockfunc(NULL, CURL_LOCK_DATA_SHARE, share->clientdata);
   free(share);
diff --git a/lib/share.h b/lib/share.h
index c0d0a5189..da3bf1765 100644
--- a/lib/share.h
+++ b/lib/share.h
@@ -7,7 +7,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+ * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -25,6 +25,7 @@
 #include "curl_setup.h"
 #include <gnurl/curl.h>
 #include "cookie.h"
+#include "psl.h"
 #include "urldata.h"
 #include "conncache.h"
 
@@ -49,6 +50,9 @@ struct Curl_share {
 #if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_COOKIES)
   struct CookieInfo *cookies;
 #endif
+#ifdef USE_LIBPSL
+  struct PslCache psl;
+#endif
 
   struct curl_ssl_session *sslsession;
   size_t max_ssl_sessions;
diff --git a/lib/smtp.c b/lib/smtp.c
index cb04cba8c..88e67f8be 100644
--- a/lib/smtp.c
+++ b/lib/smtp.c
@@ -704,7 +704,6 @@ static CURLcode smtp_state_ehlo_resp(struct connectdata 
*conn, int smtpcode,
   struct smtp_conn *smtpc = &conn->proto.smtpc;
   const char *line = data->state.buffer;
   size_t len = strlen(line);
-  size_t wordlen;
 
   (void)instate; /* no use for this yet */
 
@@ -739,6 +738,7 @@ static CURLcode smtp_state_ehlo_resp(struct connectdata 
*conn, int smtpcode,
       /* Loop through the data line */
       for(;;) {
         size_t llen;
+        size_t wordlen;
         unsigned int mechbit;
 
         while(len &&
@@ -1563,13 +1563,14 @@ CURLcode Curl_smtp_escape_eob(struct connectdata *conn, 
const ssize_t nread)
   if(!scratch || data->set.crlf) {
     oldscratch = scratch;
 
-    scratch = newscratch = malloc(2 * data->set.buffer_size);
+    scratch = newscratch = malloc(2 * UPLOAD_BUFSIZE);
     if(!newscratch) {
       failf(data, "Failed to alloc scratch buffer!");
 
       return CURLE_OUT_OF_MEMORY;
     }
   }
+  DEBUGASSERT(UPLOAD_BUFSIZE >= nread);
 
   /* Have we already sent part of the EOB? */
   eob_sent = smtp->eob;
diff --git a/lib/socks.c b/lib/socks.c
index ac4270eac..73326e5c2 100644
--- a/lib/socks.c
+++ b/lib/socks.c
@@ -57,10 +57,9 @@ int Curl_blockread_all(struct connectdata *conn, /* 
connection data */
   ssize_t nread;
   ssize_t allread = 0;
   int result;
-  timediff_t timeleft;
   *n = 0;
   for(;;) {
-    timeleft = Curl_timeleft(conn->data, NULL, TRUE);
+    timediff_t timeleft = Curl_timeleft(conn->data, NULL, TRUE);
     if(timeleft < 0) {
       /* we already got the timeout */
       result = CURLE_OPERATION_TIMEDOUT;
@@ -116,7 +115,6 @@ CURLcode Curl_SOCKS4(const char *proxy_user,
 #define SOCKS4REQLEN 262
   unsigned char socksreq[SOCKS4REQLEN]; /* room for SOCKS4 request incl. user
                                            id */
-  int result;
   CURLcode code;
   curl_socket_t sock = conn->sock[sockindex];
   struct Curl_easy *data = conn->data;
@@ -220,6 +218,7 @@ CURLcode Curl_SOCKS4(const char *proxy_user,
    * Make connection
    */
   {
+    int result;
     ssize_t actualread;
     ssize_t written;
     ssize_t hostnamelen = 0;
@@ -617,11 +616,11 @@ CURLcode Curl_SOCKS5(const char *proxy_user,
     if(dns)
       hp = dns->addr;
     if(hp) {
-      int i;
       char buf[64];
       Curl_printable_address(hp, buf, sizeof(buf));
 
       if(hp->ai_family == AF_INET) {
+        int i;
         struct sockaddr_in *saddr_in;
         socksreq[len++] = 1; /* ATYP: IPv4 = 1 */
 
@@ -634,6 +633,7 @@ CURLcode Curl_SOCKS5(const char *proxy_user,
       }
 #ifdef ENABLE_IPV6
       else if(hp->ai_family == AF_INET6) {
+        int i;
         struct sockaddr_in6 *saddr_in6;
         socksreq[len++] = 4; /* ATYP: IPv6 = 4 */
 
diff --git a/lib/splay.c b/lib/splay.c
index 69af446eb..c54a63bba 100644
--- a/lib/splay.c
+++ b/lib/splay.c
@@ -41,7 +41,6 @@ struct Curl_tree *Curl_splay(struct curltime i,
                              struct Curl_tree *t)
 {
   struct Curl_tree N, *l, *r, *y;
-  long comp;
 
   if(t == NULL)
     return t;
@@ -49,7 +48,7 @@ struct Curl_tree *Curl_splay(struct curltime i,
   l = r = &N;
 
   for(;;) {
-    comp = compare(i, t->key);
+    long comp = compare(i, t->key);
     if(comp < 0) {
       if(t->smaller == NULL)
         break;
diff --git a/lib/ssh-libssh.c b/lib/ssh-libssh.c
index c9e04db52..0bab59d03 100644
--- a/lib/ssh-libssh.c
+++ b/lib/ssh-libssh.c
@@ -204,11 +204,21 @@ static CURLcode sftp_error_to_CURLE(int err)
   return CURLE_SSH;
 }
 
+#ifndef DEBUGBUILD
+#define state(x,y) mystate(x,y)
+#else
+#define state(x,y) mystate(x,y, __LINE__)
+#endif
+
 /*
  * SSH State machine related code
  */
 /* This is the ONLY way to change SSH state! */
-static void state(struct connectdata *conn, sshstate nowstate)
+static void mystate(struct connectdata *conn, sshstate nowstate
+#ifdef DEBUGBUILD
+                    , int lineno
+#endif
+  )
 {
   struct ssh_conn *sshc = &conn->proto.sshc;
 #if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
@@ -278,8 +288,9 @@ static void state(struct connectdata *conn, sshstate 
nowstate)
 
 
   if(sshc->state != nowstate) {
-    infof(conn->data, "SSH %p state change from %s to %s\n",
-          (void *) sshc, names[sshc->state], names[nowstate]);
+    infof(conn->data, "SSH %p state change from %s to %s (line %d)\n",
+          (void *) sshc, names[sshc->state], names[nowstate],
+          lineno);
   }
 #endif
 
@@ -418,7 +429,7 @@ cleanup:
 }
 
 #define MOVE_TO_ERROR_STATE(_r) { \
-  state(conn, SSH_SESSION_FREE); \
+  state(conn, SSH_SESSION_DISCONNECT); \
   sshc->actualcode = _r; \
   rc = SSH_ERROR; \
   break; \
@@ -1306,7 +1317,7 @@ static CURLcode myssh_statemach_act(struct connectdata 
*conn, bool *block)
           if(data->set.verbose) {
             Curl_debug(data, CURLINFO_DATA_OUT,
                        (char *)sshc->readdir_filename,
-                       sshc->readdir_len, conn);
+                       sshc->readdir_len);
           }
         }
         else {
@@ -1423,7 +1434,7 @@ static CURLcode myssh_statemach_act(struct connectdata 
*conn, bool *block)
         /* output debug output if that is requested */
         if(data->set.verbose) {
           Curl_debug(data, CURLINFO_DATA_OUT, sshc->readdir_line,
-                     sshc->readdir_currLen, conn);
+                     sshc->readdir_currLen);
         }
         data->req.bytecount += sshc->readdir_currLen;
       }
@@ -2500,8 +2511,8 @@ static void sftp_quote(struct connectdata *conn)
       return;
     }
     if(data->set.verbose) {
-      Curl_debug(data, CURLINFO_HEADER_OUT, (char *) "PWD\n", 4, conn);
-      Curl_debug(data, CURLINFO_HEADER_IN, tmp, strlen(tmp), conn);
+      Curl_debug(data, CURLINFO_HEADER_OUT, (char *) "PWD\n", 4);
+      Curl_debug(data, CURLINFO_HEADER_IN, tmp, strlen(tmp));
     }
     /* this sends an FTP-like "header" to the header callback so that the
        current directory can be read very similar to how it is read when
diff --git a/lib/ssh.c b/lib/ssh.c
index 7563c467c..b289ee40b 100644
--- a/lib/ssh.c
+++ b/lib/ssh.c
@@ -1175,8 +1175,8 @@ static CURLcode ssh_statemach_act(struct connectdata 
*conn, bool *block)
           break;
         }
         if(data->set.verbose) {
-          Curl_debug(data, CURLINFO_HEADER_OUT, (char *)"PWD\n", 4, conn);
-          Curl_debug(data, CURLINFO_HEADER_IN, tmp, strlen(tmp), conn);
+          Curl_debug(data, CURLINFO_HEADER_OUT, (char *)"PWD\n", 4);
+          Curl_debug(data, CURLINFO_HEADER_IN, tmp, strlen(tmp));
         }
         /* this sends an FTP-like "header" to the header callback so that the
            current directory can be read very similar to how it is read when
@@ -1970,7 +1970,7 @@ static CURLcode ssh_statemach_act(struct connectdata 
*conn, bool *block)
           /* output debug output if that is requested */
           if(data->set.verbose) {
             Curl_debug(data, CURLINFO_DATA_OUT, sshc->readdir_filename,
-                       sshc->readdir_len, conn);
+                       sshc->readdir_len);
           }
         }
         else {
@@ -2079,7 +2079,7 @@ static CURLcode ssh_statemach_act(struct connectdata 
*conn, bool *block)
         /* output debug output if that is requested */
         if(data->set.verbose) {
           Curl_debug(data, CURLINFO_DATA_OUT, sshc->readdir_line,
-                     sshc->readdir_currLen, conn);
+                     sshc->readdir_currLen);
         }
         data->req.bytecount += sshc->readdir_currLen;
       }
diff --git a/lib/telnet.c b/lib/telnet.c
index c57098f2b..6fd339ce8 100644
--- a/lib/telnet.c
+++ b/lib/telnet.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+ * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -74,10 +74,10 @@
     x->subend = x->subpointer;                          \
     CURL_SB_CLEAR(x);                                   \
   } WHILE_FALSE
-#define CURL_SB_ACCUM(x,c)                                   \
-  do {                                                       \
-    if(x->subpointer < (x->subbuffer + sizeof x->subbuffer)) \
-      *x->subpointer++ = (c);                                \
+#define CURL_SB_ACCUM(x,c)                                      \
+  do {                                                          \
+    if(x->subpointer < (x->subbuffer + sizeof(x->subbuffer)))   \
+      *x->subpointer++ = (c);                                   \
   } WHILE_FALSE
 
 #define  CURL_SB_GET(x) ((*x->subpointer++)&0xff)
@@ -92,6 +92,7 @@
 #endif
 
 #ifdef USE_WINSOCK
+typedef WSAEVENT (WINAPI *WSOCK2_EVENT)(void);
 typedef FARPROC WSOCK2_FUNC;
 static CURLcode check_wsock2(struct Curl_easy *data);
 #endif
@@ -109,8 +110,10 @@ static void printoption(struct Curl_easy *data,
 
 static void negotiate(struct connectdata *);
 static void send_negotiation(struct connectdata *, int cmd, int option);
-static void set_local_option(struct connectdata *, int cmd, int option);
-static void set_remote_option(struct connectdata *, int cmd, int option);
+static void set_local_option(struct connectdata *conn,
+                             int option, int newstate);
+static void set_remote_option(struct connectdata *conn,
+                              int option, int newstate);
 
 static void printsub(struct Curl_easy *data,
                      int direction, unsigned char *pointer,
@@ -311,9 +314,6 @@ static void negotiate(struct connectdata *conn)
 static void printoption(struct Curl_easy *data,
                         const char *direction, int cmd, int option)
 {
-  const char *fmt;
-  const char *opt;
-
   if(data->set.verbose) {
     if(cmd == CURL_IAC) {
       if(CURL_TELCMD_OK(option))
@@ -322,9 +322,12 @@ static void printoption(struct Curl_easy *data,
         infof(data, "%s IAC %d\n", direction, option);
     }
     else {
-      fmt = (cmd == CURL_WILL) ? "WILL" : (cmd == CURL_WONT) ? "WONT" :
-        (cmd == CURL_DO) ? "DO" : (cmd == CURL_DONT) ? "DONT" : 0;
+      const char *fmt = (cmd == CURL_WILL) ? "WILL" :
+                        (cmd == CURL_WONT) ? "WONT" :
+                        (cmd == CURL_DO) ? "DO" :
+                        (cmd == CURL_DONT) ? "DONT" : 0;
       if(fmt) {
+        const char *opt;
         if(CURL_TELOPT_OK(option))
           opt = CURL_TELOPT(option);
         else if(option == CURL_TELOPT_EXOPL)
@@ -348,7 +351,6 @@ static void send_negotiation(struct connectdata *conn, int 
cmd, int option)
 {
    unsigned char buf[3];
    ssize_t bytes_written;
-   int err;
    struct Curl_easy *data = conn->data;
 
    buf[0] = CURL_IAC;
@@ -357,7 +359,7 @@ static void send_negotiation(struct connectdata *conn, int 
cmd, int option)
 
    bytes_written = swrite(conn->sock[FIRSTSOCKET], buf, 3);
    if(bytes_written < 0) {
-     err = SOCKERRNO;
+     int err = SOCKERRNO;
      failf(data,"Sending data failed (%d)",err);
    }
 
@@ -710,9 +712,8 @@ static void printsub(struct Curl_easy *data,
                      unsigned char *pointer,    /* where suboption data is */
                      size_t length)             /* length of suboption data */
 {
-  unsigned int i = 0;
-
   if(data->set.verbose) {
+    unsigned int i = 0;
     if(direction) {
       infof(data, "%s IAC SB ", (direction == '<')? "RCVD":"SENT");
       if(length >= 3) {
@@ -764,7 +765,7 @@ static void printsub(struct Curl_easy *data,
     switch(pointer[0]) {
     case CURL_TELOPT_NAWS:
       if(length > 4)
-        infof(data, "Width: %hu ; Height: %hu", (pointer[1]<<8) | pointer[2],
+        infof(data, "Width: %d ; Height: %d", (pointer[1]<<8) | pointer[2],
               (pointer[3]<<8) | pointer[4]);
       break;
     default:
@@ -928,7 +929,6 @@ static void suboption(struct connectdata *conn)
   unsigned char temp[2048];
   ssize_t bytes_written;
   size_t len;
-  size_t tmplen;
   int err;
   char varname[128] = "";
   char varval[128] = "";
@@ -968,7 +968,7 @@ static void suboption(struct connectdata *conn)
       len = 4;
 
       for(v = tn->telnet_vars; v; v = v->next) {
-        tmplen = (strlen(v->data) + 1);
+        size_t tmplen = (strlen(v->data) + 1);
         /* Add the variable only if it fits */
         if(len + tmplen < (int)sizeof(temp)-6) {
           if(sscanf(v->data, "%127[^,],%127s", varname, varval)) {
@@ -1017,7 +1017,7 @@ static void sendsuboption(struct connectdata *conn, int 
option)
     CURL_SB_ACCUM(tn, CURL_IAC);
     CURL_SB_ACCUM(tn, CURL_SB);
     CURL_SB_ACCUM(tn, CURL_TELOPT_NAWS);
-    /* We must deal either with litte or big endian processors */
+    /* We must deal either with little or big endian processors */
     /* Window size must be sent according to the 'network order' */
     x = htons(tn->subopt_wsx);
     y = htons(tn->subopt_wsy);
@@ -1223,7 +1223,7 @@ CURLcode telrcv(struct connectdata *conn,
 static CURLcode send_telnet_data(struct connectdata *conn,
                                  char *buffer, ssize_t nread)
 {
-  ssize_t escapes, i, j, outlen;
+  ssize_t escapes, i, outlen;
   unsigned char *outbuf = NULL;
   CURLcode result = CURLE_OK;
   ssize_t bytes_written, total_written;
@@ -1238,6 +1238,7 @@ static CURLcode send_telnet_data(struct connectdata *conn,
   if(outlen == nread)
     outbuf = (unsigned char *)buffer;
   else {
+    ssize_t j;
     outbuf = malloc(nread + escapes + 1);
     if(!outbuf)
       return CURLE_OUT_OF_MEMORY;
@@ -1306,7 +1307,7 @@ static CURLcode telnet_do(struct connectdata *conn, bool 
*done)
 #ifdef USE_WINSOCK
   HMODULE wsock2;
   WSOCK2_FUNC close_event_func;
-  WSOCK2_FUNC create_event_func;
+  WSOCK2_EVENT create_event_func;
   WSOCK2_FUNC event_select_func;
   WSOCK2_FUNC enum_netevents_func;
   WSAEVENT event_handle;
@@ -1315,7 +1316,6 @@ static CURLcode telnet_do(struct connectdata *conn, bool 
*done)
   HANDLE objs[2];
   DWORD  obj_count;
   DWORD  wait_timeout;
-  DWORD waitret;
   DWORD readfile_read;
   int err;
 #else
@@ -1361,7 +1361,7 @@ static CURLcode telnet_do(struct connectdata *conn, bool 
*done)
   }
 
   /* Grab a pointer to WSACreateEvent */
-  create_event_func = GetProcAddress(wsock2, "WSACreateEvent");
+  create_event_func = (WSOCK2_EVENT) GetProcAddress(wsock2, "WSACreateEvent");
   if(create_event_func == NULL) {
     failf(data, "failed to find WSACreateEvent function (%u)", GetLastError());
     FreeLibrary(wsock2);
@@ -1438,7 +1438,8 @@ static CURLcode telnet_do(struct connectdata *conn, bool 
*done)
   /* Keep on listening and act on events */
   while(keepon) {
     const DWORD buf_size = (DWORD)data->set.buffer_size;
-    waitret = WaitForMultipleObjects(obj_count, objs, FALSE, wait_timeout);
+    DWORD waitret = WaitForMultipleObjects(obj_count, objs,
+                                           FALSE, wait_timeout);
     switch(waitret) {
     case WAIT_TIMEOUT:
     {
diff --git a/lib/tftp.c b/lib/tftp.c
index 74ec0ac90..fb5aab054 100644
--- a/lib/tftp.c
+++ b/lib/tftp.c
@@ -451,7 +451,6 @@ static CURLcode tftp_send_first(tftp_state_data_t *state, 
tftp_event_t event)
   ssize_t senddata;
   const char *mode = "octet";
   char *filename;
-  char buf[64];
   struct Curl_easy *data = state->conn->data;
   CURLcode result = CURLE_OK;
 
@@ -504,6 +503,7 @@ static CURLcode tftp_send_first(tftp_state_data_t *state, 
tftp_event_t event)
 
     /* optional addition of TFTP options */
     if(!data->set.tftp_no_options) {
+      char buf[64];
       /* add tsize option */
       if(data->set.upload && (data->state.infilesize != -1))
         snprintf(buf, sizeof(buf), "%" CURL_FORMAT_CURL_OFF_T,
@@ -710,7 +710,6 @@ static CURLcode tftp_tx(tftp_state_data_t *state, 
tftp_event_t event)
 {
   struct Curl_easy *data = state->conn->data;
   ssize_t sbytes;
-  int rblock;
   CURLcode result = CURLE_OK;
   struct SingleRequest *k = &data->req;
   int cb; /* Bytes currently read */
@@ -721,7 +720,7 @@ static CURLcode tftp_tx(tftp_state_data_t *state, 
tftp_event_t event)
   case TFTP_EVENT_OACK:
     if(event == TFTP_EVENT_ACK) {
       /* Ack the packet */
-      rblock = getrpacketblock(&state->rpacket);
+      int rblock = getrpacketblock(&state->rpacket);
 
       if(rblock != state->block &&
          /* There's a bug in tftpd-hpa that causes it to send us an ack for
@@ -969,7 +968,7 @@ static CURLcode tftp_disconnect(struct connectdata *conn, 
bool dead_connection)
 static CURLcode tftp_connect(struct connectdata *conn, bool *done)
 {
   tftp_state_data_t *state;
-  int blksize, rc;
+  int blksize;
 
   blksize = TFTP_BLKSIZE_DEFAULT;
 
@@ -1028,8 +1027,8 @@ static CURLcode tftp_connect(struct connectdata *conn, 
bool *done)
      * assume uses the same IP version and thus hopefully this works for both
      * IPv4 and IPv6...
      */
-    rc = bind(state->sockfd, (struct sockaddr *)&state->local_addr,
-              conn->ip_addr->ai_addrlen);
+    int rc = bind(state->sockfd, (struct sockaddr *)&state->local_addr,
+                  conn->ip_addr->ai_addrlen);
     if(rc) {
       failf(conn->data, "bind() failed; %s",
             Curl_strerror(conn, SOCKERRNO));
@@ -1148,8 +1147,11 @@ static CURLcode tftp_receive_packet(struct connectdata 
*conn)
     case TFTP_EVENT_ERROR:
     {
       unsigned short error = getrpacketblock(&state->rpacket);
+      char *str = (char *)state->rpacket.data + 4;
+      size_t strn = state->rbytes - 4;
       state->error = (tftp_error_t)error;
-      infof(data, "%s\n", (const char *)state->rpacket.data + 4);
+      if(Curl_strnlen(str, strn) < strn)
+        infof(data, "TFTP error: %s\n", str);
       break;
     }
     case TFTP_EVENT_ACK:
@@ -1221,7 +1223,6 @@ static long tftp_state_timeout(struct connectdata *conn, 
tftp_event_t *event)
  **********************************************************/
 static CURLcode tftp_multi_statemach(struct connectdata *conn, bool *done)
 {
-  int                   rc;
   tftp_event_t          event;
   CURLcode              result = CURLE_OK;
   struct Curl_easy  *data = conn->data;
@@ -1245,7 +1246,7 @@ static CURLcode tftp_multi_statemach(struct connectdata 
*conn, bool *done)
   }
   else {
     /* no timeouts to handle, check our socket */
-    rc = SOCKET_READABLE(state->sockfd, 0);
+    int rc = SOCKET_READABLE(state->sockfd, 0);
 
     if(rc == -1) {
       /* bail out */
@@ -1368,7 +1369,6 @@ static CURLcode tftp_setup_connection(struct connectdata 
* conn)
 {
   struct Curl_easy *data = conn->data;
   char *type;
-  char command;
 
   conn->socktype = SOCK_DGRAM;   /* UDP datagram based */
 
@@ -1380,6 +1380,7 @@ static CURLcode tftp_setup_connection(struct connectdata 
* conn)
     type = strstr(conn->host.rawalloc, ";mode=");
 
   if(type) {
+    char command;
     *type = 0;                   /* it was in the middle of the hostname */
     command = Curl_raw_toupper(type[6]);
 
diff --git a/lib/transfer.c b/lib/transfer.c
index 15578109d..05c221b57 100644
--- a/lib/transfer.c
+++ b/lib/transfer.c
@@ -444,7 +444,6 @@ static CURLcode readwrite_data(struct Curl_easy *data,
   CURLcode result = CURLE_OK;
   ssize_t nread; /* number of bytes read */
   size_t excess = 0; /* excess bytes read */
-  bool is_empty_data = FALSE;
   bool readmore = FALSE; /* used by RTP to signal for more data */
   int maxloops = 100;
 
@@ -454,6 +453,7 @@ static CURLcode readwrite_data(struct Curl_easy *data,
   /* This is where we loop until we have read everything there is to
      read or we get a CURLE_AGAIN */
   do {
+    bool is_empty_data = FALSE;
     size_t buffersize = data->set.buffer_size;
     size_t bytestoread = buffersize;
 
@@ -660,14 +660,14 @@ static CURLcode readwrite_data(struct Curl_easy *data,
       if(data->set.verbose) {
         if(k->badheader) {
           Curl_debug(data, CURLINFO_DATA_IN, data->state.headerbuff,
-                     (size_t)k->hbuflen, conn);
+                     (size_t)k->hbuflen);
           if(k->badheader == HEADER_PARTHEADER)
             Curl_debug(data, CURLINFO_DATA_IN,
-                       k->str, (size_t)nread, conn);
+                       k->str, (size_t)nread);
         }
         else
           Curl_debug(data, CURLINFO_DATA_IN,
-                     k->str, (size_t)nread, conn);
+                     k->str, (size_t)nread);
       }
 
 #ifndef CURL_DISABLE_HTTP
@@ -1027,7 +1027,7 @@ static CURLcode readwrite_upload(struct Curl_easy *data,
     if(data->set.verbose)
       /* show the data before we change the pointer upload_fromhere */
       Curl_debug(data, CURLINFO_DATA_OUT, k->upload_fromhere,
-                 (size_t)bytes_written, conn);
+                 (size_t)bytes_written);
 
     k->writebytecount += bytes_written;
 
diff --git a/lib/url.c b/lib/url.c
index 701f83ab3..27b2c1e14 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -757,7 +757,7 @@ CURLcode Curl_disconnect(struct connectdata *conn, bool 
dead_connection)
    */
   if(!conn->bits.close &&
      (conn->send_pipe.size + conn->recv_pipe.size)) {
-    DEBUGF(infof(data, "Curl_disconnect, usecounter: %d\n",
+    DEBUGF(infof(data, "Curl_disconnect, usecounter: %zu\n",
                  conn->send_pipe.size + conn->recv_pipe.size));
     return CURLE_OK;
   }
@@ -965,6 +965,7 @@ static bool extract_if_dead(struct connectdata *conn,
        use */
     bool dead;
 
+    conn->data = data;
     if(conn->handler->connection_check) {
       /* The protocol has a special method for checking the state of the
          connection. Use it to check if the connection is dead. */
@@ -979,7 +980,6 @@ static bool extract_if_dead(struct connectdata *conn,
     }
 
     if(dead) {
-      conn->data = data;
       infof(data, "Connection %ld seems to be dead!\n", conn->connection_id);
       Curl_conncache_remove_conn(conn, FALSE);
       return TRUE;
@@ -1465,6 +1465,7 @@ ConnectionExists(struct Curl_easy *data,
   if(chosen) {
     /* mark it as used before releasing the lock */
     chosen->inuse = TRUE;
+    chosen->data = data; /* own it! */
     Curl_conncache_unlock(needle);
     *usethis = chosen;
     return TRUE; /* yes, we found one to use! */
@@ -1554,7 +1555,11 @@ int Curl_protocol_getsock(struct connectdata *conn,
 {
   if(conn->handler->proto_getsock)
     return conn->handler->proto_getsock(conn, socks, numsocks);
-  return GETSOCK_BLANK;
+  /* Backup getsock logic. Since there is a live socket in use, we must wait
+     for it or it will be removed from watching when the multi_socket API is
+     used. */
+  socks[0] = conn->sock[FIRSTSOCKET];
+  return GETSOCK_READSOCK(0) | GETSOCK_WRITESOCK(0);
 }
 
 int Curl_doing_getsock(struct connectdata *conn,
@@ -1999,7 +2004,6 @@ static CURLcode parseurlandfillconn(struct Curl_easy 
*data,
   char *fragment;
   char *path = data->state.path;
   char *query;
-  int i;
   int rc;
   const char *protop = "";
   CURLcode result;
@@ -2051,6 +2055,7 @@ static CURLcode parseurlandfillconn(struct Curl_easy 
*data,
     ; /* do nothing */
   }
   else { /* check for a scheme */
+    int i;
     for(i = 0; i < 16 && data->change.url[i]; ++i) {
       if(data->change.url[i] == '/')
         break;
@@ -2203,7 +2208,7 @@ static CURLcode parseurlandfillconn(struct Curl_easy 
*data,
       size_t s = strlen(slashbuf);
       protop = protobuf;
       if(s != 2) {
-        infof(data, "Unwillingly accepted illegal URL using %d slash%s!\n",
+        infof(data, "Unwillingly accepted illegal URL using %zu slash%s!\n",
               s, s>1?"es":"");
 
         if(data->change.url_alloc)
@@ -2449,7 +2454,7 @@ static CURLcode setup_range(struct Curl_easy *data)
       free(s->range);
 
     if(s->resume_from)
-      s->range = aprintf("%" CURL_FORMAT_CURL_OFF_TU "-", s->resume_from);
+      s->range = aprintf("%" CURL_FORMAT_CURL_OFF_T "-", s->resume_from);
     else
       s->range = strdup(data->set.str[STRING_SET_RANGE]);
 
@@ -2539,14 +2544,13 @@ static bool check_noproxy(const char *name, const char 
*no_proxy)
    *   not be proxied, or an asterisk to override
    *   all proxy variables)
    */
-  size_t tok_start;
-  size_t tok_end;
-  const char *separator = ", ";
-  size_t no_proxy_len;
-  size_t namelen;
-  char *endptr;
-
   if(no_proxy && no_proxy[0]) {
+    size_t tok_start;
+    size_t tok_end;
+    const char *separator = ", ";
+    size_t no_proxy_len;
+    size_t namelen;
+    char *endptr;
     if(strcasecompare("*", no_proxy)) {
       return TRUE;
     }
@@ -3166,6 +3170,13 @@ static CURLcode parse_url_login(struct Curl_easy *data,
   if(userp) {
     char *newname;
 
+    if(data->set.disallow_username_in_url) {
+      failf(data, "Option DISALLOW_USERNAME_IN_URL is set "
+                  "and url contains username.");
+      result = CURLE_LOGIN_DENIED;
+      goto out;
+    }
+
     /* We have a user in the URL */
     conn->bits.userpwd_in_url = TRUE;
     conn->bits.user_passwd = TRUE; /* enable user+password */
@@ -4297,7 +4308,9 @@ static CURLcode create_conn(struct Curl_easy *data,
       conn->data = data;
       conn->bits.tcpconnect[FIRSTSOCKET] = TRUE; /* we are "connected */
 
-      Curl_conncache_add_conn(data->state.conn_cache, conn);
+      result = Curl_conncache_add_conn(data->state.conn_cache, conn);
+      if(result)
+        goto out;
 
       /*
        * Setup whatever necessary for a resumed transfer
@@ -4474,7 +4487,7 @@ static CURLcode create_conn(struct Curl_easy *data,
           (void)Curl_disconnect(conn_candidate, /* dead_connection */ FALSE);
         }
         else {
-          infof(data, "No more connections allowed to host: %d\n",
+          infof(data, "No more connections allowed to host: %zu\n",
                 max_host_connections);
           connections_available = FALSE;
         }
@@ -4520,7 +4533,9 @@ static CURLcode create_conn(struct Curl_easy *data,
        * This is a brand new connection, so let's store it in the connection
        * cache of ours!
        */
-      Curl_conncache_add_conn(data->state.conn_cache, conn);
+      result = Curl_conncache_add_conn(data->state.conn_cache, conn);
+      if(result)
+        goto out;
     }
 
 #if defined(USE_NTLM)
@@ -4701,16 +4716,18 @@ CURLcode Curl_init_do(struct Curl_easy *data, struct 
connectdata *conn)
 {
   struct SingleRequest *k = &data->req;
 
-  conn->bits.do_more = FALSE; /* by default there's no curl_do_more() to
-                                 use */
+  if(conn) {
+    conn->bits.do_more = FALSE; /* by default there's no curl_do_more() to
+                                   use */
+    /* if the protocol used doesn't support wildcards, switch it off */
+    if(data->state.wildcardmatch &&
+       !(conn->handler->flags & PROTOPT_WILDCARD))
+      data->state.wildcardmatch = FALSE;
+  }
 
   data->state.done = FALSE; /* *_done() is not called yet */
   data->state.expect100header = FALSE;
 
-  /* if the protocol used doesn't support wildcards, switch it off */
-  if(data->state.wildcardmatch &&
-     !(conn->handler->flags & PROTOPT_WILDCARD))
-    data->state.wildcardmatch = FALSE;
 
   if(data->set.opt_no_body)
     /* in HTTP lingo, no body means using the HEAD request... */
diff --git a/lib/urldata.h b/lib/urldata.h
index 1f90ad993..524881652 100644
--- a/lib/urldata.h
+++ b/lib/urldata.h
@@ -80,6 +80,7 @@
 #define RESP_TIMEOUT (1800*1000)
 
 #include "cookie.h"
+#include "psl.h"
 #include "formdata.h"
 
 #ifdef HAVE_NETINET_IN_H
@@ -227,6 +228,7 @@ struct ssl_primary_config {
   char *random_file;     /* path to file containing "random" data */
   char *egdsocket;       /* path to file containing the EGD daemon socket */
   char *cipher_list;     /* list of ciphers to use */
+  char *cipher_list13;   /* list of TLS 1.3 cipher suites to use */
 };
 
 struct ssl_config_data {
@@ -1266,7 +1268,7 @@ struct UrlState {
   void *resolver; /* resolver state, if it is used in the URL state -
                      ares_channel f.e. */
 
-#if defined(USE_OPENSSL) && defined(HAVE_OPENSSL_ENGINE_H)
+#if defined(USE_OPENSSL)
   /* void instead of ENGINE to avoid bleeding OpenSSL into this header */
   void *engine;
 #endif /* USE_OPENSSL */
@@ -1347,7 +1349,7 @@ struct DynamicStatic {
   char *url;        /* work URL, copied from UserDefined */
   bool url_alloc;   /* URL string is malloc()'ed */
   char *referer;    /* referer string */
-  bool referer_alloc; /* referer sting is malloc()ed */
+  bool referer_alloc; /* referer string is malloc()ed */
   struct curl_slist *cookielist; /* list of cookie files set by
                                     curl_easy_setopt(COOKIEFILE) calls */
   struct curl_slist *resolve; /* set to point to the set.resolve list when
@@ -1401,6 +1403,8 @@ enum dupstring {
   STRING_SSL_PINNEDPUBLICKEY_PROXY, /* public key file to verify proxy */
   STRING_SSL_CIPHER_LIST_ORIG, /* list of ciphers to use */
   STRING_SSL_CIPHER_LIST_PROXY, /* list of ciphers to use */
+  STRING_SSL_CIPHER13_LIST_ORIG, /* list of TLS 1.3 ciphers to use */
+  STRING_SSL_CIPHER13_LIST_PROXY, /* list of TLS 1.3 ciphers to use */
   STRING_SSL_EGDSOCKET,   /* path to file containing the EGD daemon socket */
   STRING_SSL_RANDOM_FILE, /* path to file containing "random" data */
   STRING_USERAGENT,       /* User-Agent string */
@@ -1582,8 +1586,6 @@ struct UserDefined {
 /* Here follows boolean settings that define how to behave during
    this session. They are STATIC, set by libcurl users or at least initially
    and they don't change during operations. */
-
-  bool printhost;        /* printing host name in debug info */
   bool get_filetime;     /* get the time and get of the remote file */
   bool tunnel_thru_httpproxy; /* use CONNECT through a HTTP proxy */
   bool prefer_ascii;     /* ASCII rather than binary */
@@ -1677,7 +1679,7 @@ struct UserDefined {
   bool stream_depends_e; /* set or don't set the Exclusive bit */
   int stream_weight;
 
-  bool haproxyprotocol; /* whether to send HAProxy PROXY protocol header */
+  bool haproxyprotocol; /* whether to send HAProxy PROXY protocol v1 header */
 
   struct Curl_http2_dep *stream_dependents;
 
@@ -1686,6 +1688,7 @@ struct UserDefined {
   curl_resolver_start_callback resolver_start; /* optional callback called
                                                   before resolver start */
   void *resolver_start_client; /* pointer to pass to resolver start callback */
+  bool disallow_username_in_url; /* disallow username in url */
 };
 
 struct Names {
@@ -1737,6 +1740,9 @@ struct Curl_easy {
                                     struct to which this "belongs" when used
                                     by the easy interface */
   struct Curl_share *share;    /* Share, handles global variable mutexing */
+#ifdef USE_LIBPSL
+  struct PslCache *psl;        /* The associated PSL cache. */
+#endif
   struct SingleRequest req;    /* Request-specific data */
   struct UserDefined set;      /* values set by the libcurl user */
   struct DynamicStatic change; /* possibly modified userdefined data */
diff --git a/lib/vauth/digest.c b/lib/vauth/digest.c
index 8174cc8fe..430091884 100644
--- a/lib/vauth/digest.c
+++ b/lib/vauth/digest.c
@@ -158,7 +158,7 @@ static void auth_digest_sha256_to_ascii(unsigned char 
*source, /* 32 bytes */
 /* Perform quoted-string escaping as described in RFC2616 and its errata */
 static char *auth_digest_string_quoted(const char *source)
 {
-  char *dest, *d;
+  char *dest;
   const char *s = source;
   size_t n = 1; /* null terminator */
 
@@ -173,8 +173,8 @@ static char *auth_digest_string_quoted(const char *source)
 
   dest = malloc(n);
   if(dest) {
+    char *d = dest;
     s = source;
-    d = dest;
     while(*s) {
       if(*s == '"' || *s == '\\') {
         *d++ = '\\';
@@ -696,7 +696,6 @@ static CURLcode _Curl_auth_create_digest_http_message(
   unsigned char ha1[65];    /* 64 digits and 1 zero byte */
   unsigned char ha2[65];    /* 64 digits and 1 zero byte */
   char userh[65];
-  char cnoncebuf[33];
   char *cnonce = NULL;
   size_t cnonce_sz = 0;
   char *userp_quoted;
@@ -707,6 +706,7 @@ static CURLcode _Curl_auth_create_digest_http_message(
     digest->nc = 1;
 
   if(!digest->cnonce) {
+    char cnoncebuf[33];
     result = Curl_rand_hex(data, (unsigned char *)cnoncebuf,
                            sizeof(cnoncebuf));
     if(result)
diff --git a/lib/version.c b/lib/version.c
index 69b0bbaaa..99bb52810 100644
--- a/lib/version.c
+++ b/lib/version.c
@@ -445,7 +445,7 @@ curl_version_info_data *curl_version_info(CURLversion stamp)
 
 #ifdef HAVE_BROTLI
   version_info.brotli_ver_num = BrotliDecoderVersion();
-  brotli_version(brotli_buffer, sizeof brotli_buffer);
+  brotli_version(brotli_buffer, sizeof(brotli_buffer));
   version_info.brotli_version = brotli_buffer;
 #endif
 
diff --git a/lib/vtls/axtls.c b/lib/vtls/axtls.c
index 5ed898b4f..b262392a0 100644
--- a/lib/vtls/axtls.c
+++ b/lib/vtls/axtls.c
@@ -29,6 +29,11 @@
 #include "curl_setup.h"
 
 #ifdef USE_AXTLS
+
+#error axTLS support has been disabled in curl due to doubts about quality,
+#error user dedication and a lack of use/testing. We urge users to consider
+#error using a more established TLS backend instead.
+
 #include <axTLS/config.h>
 #include <axTLS/ssl.h>
 #include "axtls.h"
diff --git a/lib/vtls/cyassl.c b/lib/vtls/cyassl.c
index 20ce460e8..0e940487a 100644
--- a/lib/vtls/cyassl.c
+++ b/lib/vtls/cyassl.c
@@ -569,7 +569,7 @@ cyassl_connect_step2(struct connectdata *conn,
       return CURLE_SSL_PINNEDPUBKEYNOTMATCH;
     }
 
-    memset(&x509_parsed, 0, sizeof x509_parsed);
+    memset(&x509_parsed, 0, sizeof(x509_parsed));
     if(Curl_parseX509(&x509_parsed, x509_der, x509_der + x509_der_len))
       return CURLE_SSL_PINNEDPUBKEYNOTMATCH;
 
diff --git a/lib/vtls/darwinssl.c b/lib/vtls/darwinssl.c
index 45fe49d82..f29b5acad 100644
--- a/lib/vtls/darwinssl.c
+++ b/lib/vtls/darwinssl.c
@@ -1252,14 +1252,13 @@ static CURLcode darwinssl_version_from_curl(SSLProtocol 
*darwinver,
       return CURLE_OK;
     case CURL_SSLVERSION_TLSv1_3:
       /* TLS 1.3 support first appeared in iOS 11 and macOS 10.13 */
-#if CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11
-      /* We can assume __builtin_available() will always work in the
-         10.13/11.0 SDK: */
+#if (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) && HAVE_BUILTIN_AVAILABLE == 1
       if(__builtin_available(macOS 10.13, iOS 11.0, *)) {
         *darwinver = kTLSProtocol13;
         return CURLE_OK;
       }
-#endif /* CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11 */
+#endif /* (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) &&
+          HAVE_BUILTIN_AVAILABLE == 1 */
       break;
   }
   return CURLE_SSL_CONNECT_ERROR;
@@ -1278,7 +1277,7 @@ set_ssl_version_min_max(struct connectdata *conn, int 
sockindex)
   /* macOS 10.5-10.7 supported TLS 1.0 only.
      macOS 10.8 and later, and iOS 5 and later, added TLS 1.1 and 1.2.
      macOS 10.13 and later, and iOS 11 and later, added TLS 1.3. */
-#if CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11
+#if (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) && HAVE_BUILTIN_AVAILABLE == 1
   if(__builtin_available(macOS 10.13, iOS 11.0, *)) {
     max_supported_version_by_os = CURL_SSLVERSION_MAX_TLSv1_3;
   }
@@ -1287,7 +1286,8 @@ set_ssl_version_min_max(struct connectdata *conn, int 
sockindex)
   }
 #else
   max_supported_version_by_os = CURL_SSLVERSION_MAX_TLSv1_2;
-#endif /* CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11 */
+#endif /* (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) &&
+          HAVE_BUILTIN_AVAILABLE == 1 */
 
   switch(ssl_version) {
     case CURL_SSLVERSION_DEFAULT:
@@ -1430,7 +1430,7 @@ static CURLcode darwinssl_connect_step1(struct 
connectdata *conn,
     case CURL_SSLVERSION_DEFAULT:
     case CURL_SSLVERSION_TLSv1:
       (void)SSLSetProtocolVersionMin(BACKEND->ssl_ctx, kTLSProtocol1);
-#if CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11
+#if (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) && HAVE_BUILTIN_AVAILABLE == 1
       if(__builtin_available(macOS 10.13, iOS 11.0, *)) {
         (void)SSLSetProtocolVersionMax(BACKEND->ssl_ctx, kTLSProtocol13);
       }
@@ -1439,7 +1439,8 @@ static CURLcode darwinssl_connect_step1(struct 
connectdata *conn,
       }
 #else
       (void)SSLSetProtocolVersionMax(BACKEND->ssl_ctx, kTLSProtocol12);
-#endif /* CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11 */
+#endif /* (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) &&
+          HAVE_BUILTIN_AVAILABLE == 1 */
       break;
     case CURL_SSLVERSION_TLSv1_0:
     case CURL_SSLVERSION_TLSv1_1:
diff --git a/lib/vtls/gskit.c b/lib/vtls/gskit.c
index a04d791af..2627e5bbc 100644
--- a/lib/vtls/gskit.c
+++ b/lib/vtls/gskit.c
@@ -328,7 +328,7 @@ static CURLcode set_ciphers(struct connectdata *conn,
      GSKit tokens are always shorter than their cipher names, allocated buffers
      will always be large enough to accommodate the result. */
   l = strlen(cipherlist) + 1;
-  memset((char *) ciphers, 0, sizeof ciphers);
+  memset((char *) ciphers, 0, sizeof(ciphers));
   for(i = 0; i < CURL_GSKPROTO_LAST; i++) {
     ciphers[i].buf = malloc(l);
     if(!ciphers[i].buf) {
@@ -536,18 +536,18 @@ inetsocketpair(int sv[2])
   lfd = socket(AF_INET, SOCK_STREAM, 0);
   if(lfd < 0)
     return -1;
-  memset((char *) &addr1, 0, sizeof addr1);
+  memset((char *) &addr1, 0, sizeof(addr1));
   addr1.sin_family = AF_INET;
   addr1.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
   addr1.sin_port = 0;
-  if(bind(lfd, (struct sockaddr *) &addr1, sizeof addr1) ||
+  if(bind(lfd, (struct sockaddr *) &addr1, sizeof(addr1)) ||
      listen(lfd, 2) < 0) {
     close(lfd);
     return -1;
   }
 
   /* Get the allocated port. */
-  len = sizeof addr1;
+  len = sizeof(addr1);
   if(getsockname(lfd, (struct sockaddr *) &addr1, &len) < 0) {
     close(lfd);
     return -1;
@@ -562,7 +562,7 @@ inetsocketpair(int sv[2])
 
   /* Request unblocking connection to the listening socket. */
   curlx_nonblock(cfd, TRUE);
-  if(connect(cfd, (struct sockaddr *) &addr1, sizeof addr1) < 0 &&
+  if(connect(cfd, (struct sockaddr *) &addr1, sizeof(addr1)) < 0 &&
      errno != EINPROGRESS) {
     close(lfd);
     close(cfd);
@@ -570,7 +570,7 @@ inetsocketpair(int sv[2])
   }
 
   /* Get the client dynamic port for intrusion check below. */
-  len = sizeof addr2;
+  len = sizeof(addr2);
   if(getsockname(cfd, (struct sockaddr *) &addr2, &len) < 0) {
     close(lfd);
     close(cfd);
@@ -580,7 +580,7 @@ inetsocketpair(int sv[2])
   /* Accept the incoming connection and get the server socket. */
   curlx_nonblock(lfd, TRUE);
   for(;;) {
-    len = sizeof addr1;
+    len = sizeof(addr1);
     sfd = accept(lfd, (struct sockaddr *) &addr1, &len);
     if(sfd < 0) {
       close(lfd);
@@ -644,7 +644,7 @@ static int pipe_ssloverssl(struct connectdata *conn, int 
sockindex,
     /* Try getting data from HTTPS proxy and pipe it upstream. */
     n = 0;
     i = gsk_secure_soc_read(connproxyssl->backend->handle,
-                            buf, sizeof buf, &n);
+                            buf, sizeof(buf), &n);
     switch(i) {
     case GSK_OK:
       if(n) {
@@ -665,7 +665,7 @@ static int pipe_ssloverssl(struct connectdata *conn, int 
sockindex,
   if(FD_ISSET(BACKEND->remotefd, &fds_read) &&
      FD_ISSET(conn->sock[sockindex], &fds_write)) {
     /* Pipe data to HTTPS proxy. */
-    n = read(BACKEND->remotefd, buf, sizeof buf);
+    n = read(BACKEND->remotefd, buf, sizeof(buf));
     if(n < 0)
       return -1;
     if(n) {
@@ -864,13 +864,13 @@ static CURLcode gskit_connect_step1(struct connectdata 
*conn, int sockindex)
     BACKEND->localfd = sockpair[0];
     BACKEND->remotefd = sockpair[1];
     setsockopt(BACKEND->localfd, SOL_SOCKET, SO_RCVBUF,
-               (void *) sobufsize, sizeof sobufsize);
+               (void *) sobufsize, sizeof(sobufsize));
     setsockopt(BACKEND->remotefd, SOL_SOCKET, SO_RCVBUF,
-               (void *) sobufsize, sizeof sobufsize);
+               (void *) sobufsize, sizeof(sobufsize));
     setsockopt(BACKEND->localfd, SOL_SOCKET, SO_SNDBUF,
-               (void *) sobufsize, sizeof sobufsize);
+               (void *) sobufsize, sizeof(sobufsize));
     setsockopt(BACKEND->remotefd, SOL_SOCKET, SO_SNDBUF,
-               (void *) sobufsize, sizeof sobufsize);
+               (void *) sobufsize, sizeof(sobufsize));
     curlx_nonblock(BACKEND->localfd, TRUE);
     curlx_nonblock(BACKEND->remotefd, TRUE);
   }
@@ -977,7 +977,7 @@ static CURLcode gskit_connect_step1(struct connectdata 
*conn, int sockindex)
 
   if(!result) {
     /* Start handshake. Try asynchronous first. */
-    memset(&commarea, 0, sizeof commarea);
+    memset(&commarea, 0, sizeof(commarea));
     BACKEND->iocport = QsoCreateIOCompletionPort();
     if(BACKEND->iocport != -1) {
       result = gskit_status(data,
@@ -1333,11 +1333,11 @@ static int Curl_gskit_check_cxn(struct connectdata *cxn)
     return 0; /* connection has been closed */
 
   err = 0;
-  errlen = sizeof err;
+  errlen = sizeof(err);
 
   if(getsockopt(cxn->sock[FIRSTSOCKET], SOL_SOCKET, SO_ERROR,
                  (unsigned char *) &err, &errlen) ||
-     errlen != sizeof err || err)
+     errlen != sizeof(err) || err)
     return 0; /* connection has been closed */
 
   return -1;  /* connection status unknown */
diff --git a/lib/vtls/nss.c b/lib/vtls/nss.c
index 7cd450cda..89f818397 100644
--- a/lib/vtls/nss.c
+++ b/lib/vtls/nss.c
@@ -394,7 +394,7 @@ static PK11SlotInfo* nss_find_slot_by_name(const char 
*slot_name)
 /* wrap 'ptr' as list node and tail-insert into 'list' */
 static CURLcode insert_wrapped_ptr(struct curl_llist *list, void *ptr)
 {
-  struct ptr_list_wrap *wrap = malloc(sizeof *wrap);
+  struct ptr_list_wrap *wrap = malloc(sizeof(*wrap));
   if(!wrap)
     return CURLE_OUT_OF_MEMORY;
 
@@ -914,11 +914,11 @@ static CURLcode display_conn_info(struct connectdata 
*conn, PRFileDesc *sock)
   PRTime now;
   int i;
 
-  if(SSL_GetChannelInfo(sock, &channel, sizeof channel) ==
-     SECSuccess && channel.length == sizeof channel &&
+  if(SSL_GetChannelInfo(sock, &channel, sizeof(channel)) ==
+     SECSuccess && channel.length == sizeof(channel) &&
      channel.cipherSuite) {
     if(SSL_GetCipherSuiteInfo(channel.cipherSuite,
-                              &suite, sizeof suite) == SECSuccess) {
+                              &suite, sizeof(suite)) == SECSuccess) {
       infof(conn->data, "SSL connection using %s\n", suite.cipherSuiteName);
     }
   }
@@ -1345,7 +1345,8 @@ static CURLcode nss_init(struct Curl_easy *data)
       return CURLE_OUT_OF_MEMORY;
 
     /* the default methods just call down to the lower I/O layer */
-    memcpy(&nspr_io_methods, PR_GetDefaultIOMethods(), sizeof nspr_io_methods);
+    memcpy(&nspr_io_methods, PR_GetDefaultIOMethods(),
+           sizeof(nspr_io_methods));
 
     /* override certain methods in the table by our wrappers */
     nspr_io_methods.recv  = nspr_io_recv;
diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
index f6a4bd3fb..0b1929bd7 100644
--- a/lib/vtls/openssl.c
+++ b/lib/vtls/openssl.c
@@ -50,9 +50,6 @@
 #include "hostcheck.h"
 #include "curl_printf.h"
 #include <openssl/ssl.h>
-#ifdef HAVE_OPENSSL_ENGINE_H
-#include <openssl/engine.h>
-#endif
 #include <openssl/rand.h>
 #include <openssl/x509v3.h>
 #ifndef OPENSSL_NO_DSA
@@ -72,6 +69,12 @@
 #include <openssl/ocsp.h>
 #endif
 
+#if (OPENSSL_VERSION_NUMBER >= 0x10001000L) && /* 1.0.1 or later */     \
+  !defined(OPENSSL_NO_ENGINE)
+#define USE_OPENSSL_ENGINE
+#include <openssl/engine.h>
+#endif
+
 #include "warnless.h"
 #include "non-ascii.h" /* for Curl_convert_from_utf8 prototype */
 
@@ -83,7 +86,7 @@
 #error "OPENSSL_VERSION_NUMBER not defined"
 #endif
 
-#if defined(HAVE_OPENSSL_ENGINE_H)
+#ifdef USE_OPENSSL_ENGINE
 #include <openssl/ui.h>
 #endif
 
@@ -166,6 +169,17 @@ static unsigned long OpenSSL_version_num(void)
 #define HAVE_KEYLOG_CALLBACK
 #endif
 
+/* Whether SSL_CTX_set_ciphersuites is available.
+ * OpenSSL: supported since 1.1.1 (commit a53b5be6a05)
+ * BoringSSL: no
+ * LibreSSL: no
+ */
+#if ((OPENSSL_VERSION_NUMBER >= 0x10101000L) && \
+     !defined(LIBRESSL_VERSION_NUMBER) &&       \
+     !defined(OPENSSL_IS_BORINGSSL))
+#define HAVE_SSL_CTX_SET_CIPHERSUITES
+#endif
+
 #if defined(LIBRESSL_VERSION_NUMBER)
 #define OSSL_PACKAGE "LibreSSL"
 #elif defined(OPENSSL_IS_BORINGSSL)
@@ -504,7 +518,7 @@ static int do_file_type(const char *type)
   return -1;
 }
 
-#if defined(HAVE_OPENSSL_ENGINE_H)
+#ifdef USE_OPENSSL_ENGINE
 /*
  * Supply default password to the engine user interface conversation.
  * The password is passed by OpenSSL engine from ENGINE_load_private_key()
@@ -606,7 +620,7 @@ int cert_stuff(struct connectdata *conn,
       }
       break;
     case SSL_FILETYPE_ENGINE:
-#if defined(HAVE_OPENSSL_ENGINE_H) && defined(ENGINE_CTRL_GET_CMD_FROM_NAME)
+#if defined(USE_OPENSSL_ENGINE) && defined(ENGINE_CTRL_GET_CMD_FROM_NAME)
       {
         if(data->state.engine) {
           const char *cmd_name = "LOAD_CERT_CTRL";
@@ -781,7 +795,7 @@ int cert_stuff(struct connectdata *conn,
       }
       break;
     case SSL_FILETYPE_ENGINE:
-#ifdef HAVE_OPENSSL_ENGINE_H
+#ifdef USE_OPENSSL_ENGINE
       {                         /* XXXX still needs some work */
         EVP_PKEY *priv_key = NULL;
         if(data->state.engine) {
@@ -1088,7 +1102,7 @@ static int Curl_ossl_check_cxn(struct connectdata *conn)
 static CURLcode Curl_ossl_set_engine(struct Curl_easy *data,
                                      const char *engine)
 {
-#if defined(USE_OPENSSL) && defined(HAVE_OPENSSL_ENGINE_H)
+#ifdef USE_OPENSSL_ENGINE
   ENGINE *e;
 
 #if OPENSSL_VERSION_NUMBER >= 0x00909000L
@@ -1133,7 +1147,7 @@ static CURLcode Curl_ossl_set_engine(struct Curl_easy 
*data,
  */
 static CURLcode Curl_ossl_set_engine_default(struct Curl_easy *data)
 {
-#ifdef HAVE_OPENSSL_ENGINE_H
+#ifdef USE_OPENSSL_ENGINE
   if(data->state.engine) {
     if(ENGINE_set_default(data->state.engine, ENGINE_METHOD_ALL) > 0) {
       infof(data, "set default crypto engine '%s'\n",
@@ -1156,7 +1170,7 @@ static CURLcode Curl_ossl_set_engine_default(struct 
Curl_easy *data)
 static struct curl_slist *Curl_ossl_engines_list(struct Curl_easy *data)
 {
   struct curl_slist *list = NULL;
-#if defined(USE_OPENSSL) && defined(HAVE_OPENSSL_ENGINE_H)
+#ifdef USE_OPENSSL_ENGINE
   struct curl_slist *beg;
   ENGINE *e;
 
@@ -1312,7 +1326,7 @@ static void Curl_ossl_session_free(void *ptr)
  */
 static void Curl_ossl_close_all(struct Curl_easy *data)
 {
-#ifdef HAVE_OPENSSL_ENGINE_H
+#ifdef USE_OPENSSL_ENGINE
   if(data->state.engine) {
     ENGINE_finish(data->state.engine);
     ENGINE_free(data->state.engine);
@@ -1931,12 +1945,12 @@ static void ssl_tls_trace(int direction, int ssl_ver, 
int content_type,
                        verstr, direction?"OUT":"IN",
                        tls_rt_name, msg_name, msg_type);
     if(0 <= txt_len && (unsigned)txt_len < sizeof(ssl_buf)) {
-      Curl_debug(data, CURLINFO_TEXT, ssl_buf, (size_t)txt_len, NULL);
+      Curl_debug(data, CURLINFO_TEXT, ssl_buf, (size_t)txt_len);
     }
   }
 
   Curl_debug(data, (direction == 1) ? CURLINFO_SSL_DATA_OUT :
-             CURLINFO_SSL_DATA_IN, (char *)buf, len, NULL);
+             CURLINFO_SSL_DATA_IN, (char *)buf, len);
   (void) ssl;
 }
 #endif
@@ -2064,10 +2078,6 @@ set_ssl_version_min_max(long *ctx_options, struct 
connectdata *conn,
   long ssl_version = SSL_CONN_CONFIG(version);
   long ssl_version_max = SSL_CONN_CONFIG(version_max);
 
-  if(ssl_version_max == CURL_SSLVERSION_MAX_NONE) {
-    ssl_version_max = ssl_version << 16;
-  }
-
   switch(ssl_version) {
     case CURL_SSLVERSION_TLSv1_3:
 #ifdef TLS1_3_VERSION
@@ -2099,8 +2109,7 @@ set_ssl_version_min_max(long *ctx_options, struct 
connectdata *conn,
 #endif
       /* FALLTHROUGH */
     case CURL_SSLVERSION_TLSv1_0:
-      *ctx_options |= SSL_OP_NO_SSLv2;
-      *ctx_options |= SSL_OP_NO_SSLv3;
+    case CURL_SSLVERSION_TLSv1:
       break;
   }
 
@@ -2116,12 +2125,12 @@ set_ssl_version_min_max(long *ctx_options, struct 
connectdata *conn,
 #endif
       /* FALLTHROUGH */
     case CURL_SSLVERSION_MAX_TLSv1_2:
-    case CURL_SSLVERSION_MAX_DEFAULT:
 #ifdef TLS1_3_VERSION
       *ctx_options |= SSL_OP_NO_TLSv1_3;
 #endif
       break;
     case CURL_SSLVERSION_MAX_TLSv1_3:
+    case CURL_SSLVERSION_MAX_DEFAULT:
 #ifdef TLS1_3_VERSION
       break;
 #else
@@ -2305,11 +2314,6 @@ static CURLcode ossl_connect_step1(struct connectdata 
*conn, int sockindex)
 
   switch(ssl_version) {
   case CURL_SSLVERSION_SSLv3:
-#ifdef USE_TLS_SRP
-    if(ssl_authtype == CURL_TLSAUTH_SRP) {
-      infof(data, "Set version TLSv1.x for SRP authorisation\n");
-    }
-#endif
     ctx_options |= SSL_OP_NO_SSLv2;
     ctx_options |= SSL_OP_NO_TLSv1;
 #if OPENSSL_VERSION_NUMBER >= 0x1000100FL
@@ -2323,21 +2327,20 @@ static CURLcode ossl_connect_step1(struct connectdata 
*conn, int sockindex)
 
   case CURL_SSLVERSION_DEFAULT:
   case CURL_SSLVERSION_TLSv1:
-    ctx_options |= SSL_OP_NO_SSLv2;
-    ctx_options |= SSL_OP_NO_SSLv3;
-    break;
-
   case CURL_SSLVERSION_TLSv1_0:
   case CURL_SSLVERSION_TLSv1_1:
   case CURL_SSLVERSION_TLSv1_2:
   case CURL_SSLVERSION_TLSv1_3:
+    /* asking for any TLS version as the minimum, means no SSL versions
+       allowed */
+    ctx_options |= SSL_OP_NO_SSLv2;
+    ctx_options |= SSL_OP_NO_SSLv3;
     result = set_ssl_version_min_max(&ctx_options, conn, sockindex);
     if(result != CURLE_OK)
        return result;
     break;
 
   case CURL_SSLVERSION_SSLv2:
-#ifndef OPENSSL_NO_SSL2
     ctx_options |= SSL_OP_NO_SSLv3;
     ctx_options |= SSL_OP_NO_TLSv1;
 #if OPENSSL_VERSION_NUMBER >= 0x1000100FL
@@ -2348,10 +2351,6 @@ static CURLcode ossl_connect_step1(struct connectdata 
*conn, int sockindex)
 #endif
 #endif
     break;
-#else
-    failf(data, OSSL_PACKAGE " was built without SSLv2 support");
-    return CURLE_NOT_BUILT_IN;
-#endif
 
   default:
     failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION");
@@ -2414,6 +2413,19 @@ static CURLcode ossl_connect_step1(struct connectdata 
*conn, int sockindex)
     infof(data, "Cipher selection: %s\n", ciphers);
   }
 
+#ifdef HAVE_SSL_CTX_SET_CIPHERSUITES
+  {
+    char *ciphers13 = SSL_CONN_CONFIG(cipher_list13);
+    if(ciphers13) {
+      if(!SSL_CTX_set_ciphersuites(BACKEND->ctx, ciphers13)) {
+        failf(data, "failed setting TLS 1.3 cipher suite: %s", ciphers);
+        return CURLE_SSL_CIPHER;
+      }
+      infof(data, "TLS 1.3 cipher selection: %s\n", ciphers13);
+    }
+  }
+#endif
+
 #ifdef USE_TLS_SRP
   if(ssl_authtype == CURL_TLSAUTH_SRP) {
     char * const ssl_username = SSL_SET_OPTION(username);
diff --git a/lib/vtls/schannel.c b/lib/vtls/schannel.c
index 2cfd5c19f..382efb525 100644
--- a/lib/vtls/schannel.c
+++ b/lib/vtls/schannel.c
@@ -90,11 +90,17 @@
 #endif
 #endif
 
+#if defined(CryptStringToBinary) && defined(CRYPT_STRING_HEX)
+#define HAS_CLIENT_CERT_PATH
+#endif
+
+#ifdef HAS_CLIENT_CERT_PATH
 #ifdef UNICODE
 #define CURL_CERT_STORE_PROV_SYSTEM CERT_STORE_PROV_SYSTEM_W
 #else
 #define CURL_CERT_STORE_PROV_SYSTEM CERT_STORE_PROV_SYSTEM_A
 #endif
+#endif
 
 #ifndef SP_PROT_SSL2_CLIENT
 #define SP_PROT_SSL2_CLIENT             0x00000008
@@ -199,6 +205,147 @@ set_ssl_version_min_max(SCHANNEL_CRED *schannel_cred, 
struct connectdata *conn)
   return CURLE_OK;
 }
 
+/*longest is 26, buffer is slightly bigger*/
+#define LONGEST_ALG_ID 32
+#define CIPHEROPTION(X) \
+if(strcmp(#X, tmp) == 0) \
+  return X
+
+static int
+get_alg_id_by_name(char *name)
+{
+  char tmp[LONGEST_ALG_ID] = { 0 };
+  char *nameEnd = strchr(name, ':');
+  size_t n = nameEnd ? min((size_t)(nameEnd - name), LONGEST_ALG_ID - 1) : \
+    min(strlen(name), LONGEST_ALG_ID - 1);
+  strncpy(tmp, name, n);
+  tmp[n] = 0;
+  CIPHEROPTION(CALG_MD2);
+  CIPHEROPTION(CALG_MD4);
+  CIPHEROPTION(CALG_MD5);
+  CIPHEROPTION(CALG_SHA);
+  CIPHEROPTION(CALG_SHA1);
+  CIPHEROPTION(CALG_MAC);
+  CIPHEROPTION(CALG_RSA_SIGN);
+  CIPHEROPTION(CALG_DSS_SIGN);
+/*ifdefs for the options that are defined conditionally in wincrypt.h*/
+#ifdef CALG_NO_SIGN
+  CIPHEROPTION(CALG_NO_SIGN);
+#endif
+  CIPHEROPTION(CALG_RSA_KEYX);
+  CIPHEROPTION(CALG_DES);
+#ifdef CALG_3DES_112
+  CIPHEROPTION(CALG_3DES_112);
+#endif
+  CIPHEROPTION(CALG_3DES);
+  CIPHEROPTION(CALG_DESX);
+  CIPHEROPTION(CALG_RC2);
+  CIPHEROPTION(CALG_RC4);
+  CIPHEROPTION(CALG_SEAL);
+#ifdef CALG_DH_SF
+  CIPHEROPTION(CALG_DH_SF);
+#endif
+  CIPHEROPTION(CALG_DH_EPHEM);
+#ifdef CALG_AGREEDKEY_ANY
+  CIPHEROPTION(CALG_AGREEDKEY_ANY);
+#endif
+#ifdef CALG_HUGHES_MD5
+  CIPHEROPTION(CALG_HUGHES_MD5);
+#endif
+  CIPHEROPTION(CALG_SKIPJACK);
+#ifdef CALG_TEK
+  CIPHEROPTION(CALG_TEK);
+#endif
+  CIPHEROPTION(CALG_CYLINK_MEK);
+  CIPHEROPTION(CALG_SSL3_SHAMD5);
+#ifdef CALG_SSL3_MASTER
+  CIPHEROPTION(CALG_SSL3_MASTER);
+#endif
+#ifdef CALG_SCHANNEL_MASTER_HASH
+  CIPHEROPTION(CALG_SCHANNEL_MASTER_HASH);
+#endif
+#ifdef CALG_SCHANNEL_MAC_KEY
+  CIPHEROPTION(CALG_SCHANNEL_MAC_KEY);
+#endif
+#ifdef CALG_SCHANNEL_ENC_KEY
+  CIPHEROPTION(CALG_SCHANNEL_ENC_KEY);
+#endif
+#ifdef CALG_PCT1_MASTER
+  CIPHEROPTION(CALG_PCT1_MASTER);
+#endif
+#ifdef CALG_SSL2_MASTER
+  CIPHEROPTION(CALG_SSL2_MASTER);
+#endif
+#ifdef CALG_TLS1_MASTER
+  CIPHEROPTION(CALG_TLS1_MASTER);
+#endif
+#ifdef CALG_RC5
+  CIPHEROPTION(CALG_RC5);
+#endif
+#ifdef CALG_HMAC
+  CIPHEROPTION(CALG_HMAC);
+#endif
+  CIPHEROPTION(CALG_TLS1PRF);
+#ifdef CALG_HASH_REPLACE_OWF
+  CIPHEROPTION(CALG_HASH_REPLACE_OWF);
+#endif
+#ifdef CALG_AES_128
+  CIPHEROPTION(CALG_AES_128);
+#endif
+#ifdef CALG_AES_192
+  CIPHEROPTION(CALG_AES_192);
+#endif
+#ifdef CALG_AES_256
+  CIPHEROPTION(CALG_AES_256);
+#endif
+#ifdef CALG_AES
+  CIPHEROPTION(CALG_AES);
+#endif
+#ifdef CALG_SHA_256
+  CIPHEROPTION(CALG_SHA_256);
+#endif
+#ifdef CALG_SHA_384
+  CIPHEROPTION(CALG_SHA_384);
+#endif
+#ifdef CALG_SHA_512
+  CIPHEROPTION(CALG_SHA_512);
+#endif
+#ifdef CALG_ECDH
+  CIPHEROPTION(CALG_ECDH);
+#endif
+#ifdef CALG_ECMQV
+  CIPHEROPTION(CALG_ECMQV);
+#endif
+#ifdef CALG_ECDSA
+  CIPHEROPTION(CALG_ECDSA);
+#endif
+  return 0;
+}
+
+static CURLcode
+set_ssl_ciphers(SCHANNEL_CRED *schannel_cred, char *ciphers)
+{
+  char *startCur = ciphers;
+  int algCount = 0;
+  static ALG_ID algIds[45]; /*There are 45 listed in the MS headers*/
+  while(startCur && (0 != *startCur) && (algCount < 45)) {
+    long alg = strtol(startCur, 0, 0);
+    if(!alg)
+      alg = get_alg_id_by_name(startCur);
+    if(alg)
+      algIds[algCount++] = alg;
+    else
+      return CURLE_SSL_CIPHER;
+    startCur = strchr(startCur, ':');
+    if(startCur)
+      startCur++;
+  }
+    schannel_cred->palgSupportedAlgs = algIds;
+  schannel_cred->cSupportedAlgs = algCount;
+  return CURLE_OK;
+}
+
+#ifdef HAS_CLIENT_CERT_PATH
 static CURLcode
 get_cert_location(TCHAR *path, DWORD *store_name, TCHAR **store_path,
                   TCHAR **thumbprint)
@@ -248,6 +395,7 @@ get_cert_location(TCHAR *path, DWORD *store_name, TCHAR 
**store_path,
 
   return CURLE_OK;
 }
+#endif
 
 static CURLcode
 schannel_connect_step1(struct connectdata *conn, int sockindex)
@@ -299,10 +447,15 @@ schannel_connect_step1(struct connectdata *conn, int 
sockindex)
 #endif
 
 #ifdef _WIN32_WCE
+#ifdef HAS_MANUAL_VERIFY_API
   /* certificate validation on CE doesn't seem to work right; we'll
    * do it following a more manual process. */
   BACKEND->use_manual_cred_validation = true;
 #else
+#error "compiler too old to support requisite manual cert verify for Win CE"
+#endif
+#else
+#ifdef HAS_MANUAL_VERIFY_API
   if(SSL_CONN_CONFIG(CAfile)) {
     if(Curl_verify_windows_version(6, 1, PLATFORM_WINNT,
                                    VERSION_GREATER_THAN_EQUAL)) {
@@ -316,6 +469,12 @@ schannel_connect_step1(struct connectdata *conn, int 
sockindex)
   }
   else
     BACKEND->use_manual_cred_validation = false;
+#else
+  if(SSL_CONN_CONFIG(CAfile)) {
+    failf(data, "schannel: CA cert support not built in");
+    return CURLE_NOT_BUILT_IN;
+  }
+#endif
 #endif
 
   BACKEND->cred = NULL;
@@ -341,9 +500,11 @@ schannel_connect_step1(struct connectdata *conn, int 
sockindex)
     schannel_cred.dwVersion = SCHANNEL_CRED_VERSION;
 
     if(conn->ssl_config.verifypeer) {
+#ifdef HAS_MANUAL_VERIFY_API
       if(BACKEND->use_manual_cred_validation)
         schannel_cred.dwFlags = SCH_CRED_MANUAL_CRED_VALIDATION;
       else
+#endif
         schannel_cred.dwFlags = SCH_CRED_AUTO_CRED_VALIDATION;
 
       /* TODO s/data->set.ssl.no_revoke/SSL_SET_OPTION(no_revoke)/g */
@@ -401,6 +562,16 @@ schannel_connect_step1(struct connectdata *conn, int 
sockindex)
       return CURLE_SSL_CONNECT_ERROR;
     }
 
+    if(SSL_CONN_CONFIG(cipher_list)) {
+      result = set_ssl_ciphers(&schannel_cred, SSL_CONN_CONFIG(cipher_list));
+      if(CURLE_OK != result) {
+        failf(data, "Unable to set ciphers to passed via SSL_CONN_CONFIG");
+        return result;
+      }
+    }
+
+
+#ifdef HAS_CLIENT_CERT_PATH
     /* client certificate */
     if(data->set.ssl.cert) {
       DWORD cert_store_name;
@@ -417,6 +588,8 @@ schannel_connect_step1(struct connectdata *conn, int 
sockindex)
       result = get_cert_location(cert_path, &cert_store_name,
                                  &cert_store_path, &cert_thumbprint_str);
       if(result != CURLE_OK) {
+        failf(data, "schannel: Failed to get certificate location for %s",
+              cert_path);
         Curl_unicodefree(cert_path);
         return result;
       }
@@ -425,6 +598,8 @@ schannel_connect_step1(struct connectdata *conn, int 
sockindex)
                                  (HCRYPTPROV)NULL,
                                  cert_store_name, cert_store_path);
       if(!cert_store) {
+        failf(data, "schannel: Failed to open cert store %s %s",
+              cert_store_name, cert_store_path);
         Curl_unicodefree(cert_path);
         return CURLE_SSL_CONNECT_ERROR;
       }
@@ -453,6 +628,12 @@ schannel_connect_step1(struct connectdata *conn, int 
sockindex)
 
       CertCloseStore(cert_store, 0);
     }
+#else
+    if(data->set.ssl.cert) {
+      failf(data, "schannel: client cert support not built in");
+      return CURLE_NOT_BUILT_IN;
+    }
+#endif
 
     /* allocate memory for the re-usable credential handle */
     BACKEND->cred = (struct curl_schannel_cred *)
@@ -877,9 +1058,11 @@ schannel_connect_step2(struct connectdata *conn, int 
sockindex)
     }
   }
 
+#ifdef HAS_MANUAL_VERIFY_API
   if(conn->ssl_config.verifypeer && BACKEND->use_manual_cred_validation) {
     return verify_certificate(conn, sockindex);
   }
+#endif
 
   return CURLE_OK;
 }
@@ -1819,7 +2002,7 @@ static CURLcode pkp_pin_peer_pubkey(struct connectdata 
*conn, int sockindex,
 
     x509_der = (const char *)pCertContextServer->pbCertEncoded;
     x509_der_len = pCertContextServer->cbCertEncoded;
-    memset(&x509_parsed, 0, sizeof x509_parsed);
+    memset(&x509_parsed, 0, sizeof(x509_parsed));
     if(Curl_parseX509(&x509_parsed, x509_der, x509_der + x509_der_len))
       break;
 
@@ -1870,7 +2053,8 @@ static void Curl_schannel_checksum(const unsigned char 
*input,
     if(!CryptCreateHash(hProv, algId, 0, 0, &hHash))
       break; /* failed */
 
-    if(!CryptHashData(hHash, (const BYTE*)input, (DWORD)inputlen, 0))
+    /* workaround for original MinGW, should be (const BYTE*) */
+    if(!CryptHashData(hHash, (BYTE*)input, (DWORD)inputlen, 0))
       break; /* failed */
 
     /* get hash size */
diff --git a/lib/vtls/schannel.h b/lib/vtls/schannel.h
index 447690027..51417affe 100644
--- a/lib/vtls/schannel.h
+++ b/lib/vtls/schannel.h
@@ -32,12 +32,44 @@
 
 #include "urldata.h"
 
+/* <wincrypt.h> has been included via the above <schnlsp.h>.
+ * Or in case of ldap.c, it was included via <winldap.h>.
+ * And since <wincrypt.h> has this:
+ *   #define X509_NAME  ((LPCSTR) 7)
+ *
+ * And in BoringSSL's <openssl/base.h> there is:
+ *  typedef struct X509_name_st X509_NAME;
+ *  etc.
+ *
+ * this wil cause all kinds of C-preprocessing paste errors in
+ * BoringSSL's <openssl/x509.h>: So just undefine those defines here
+ * (and only here).
+ */
+#if defined(HAVE_BORINGSSL) || defined(OPENSSL_IS_BORINGSSL)
+# undef X509_NAME
+# undef X509_CERT_PAIR
+# undef X509_EXTENSIONS
+#endif
+
 extern const struct Curl_ssl Curl_ssl_schannel;
 
 CURLcode verify_certificate(struct connectdata *conn, int sockindex);
 
 /* structs to expose only in schannel.c and schannel_verify.c */
 #ifdef EXPOSE_SCHANNEL_INTERNAL_STRUCTS
+
+#ifdef __MINGW32__
+#include <_mingw.h>
+#ifdef __MINGW64_VERSION_MAJOR
+#define HAS_MANUAL_VERIFY_API
+#endif
+#else
+#include <wincrypt.h>
+#ifdef CERT_CHAIN_REVOCATION_CHECK_CHAIN
+#define HAS_MANUAL_VERIFY_API
+#endif
+#endif
+
 struct curl_schannel_cred {
   CredHandle cred_handle;
   TimeStamp time_stamp;
@@ -66,7 +98,9 @@ struct ssl_backend_data {
   bool recv_sspi_close_notify; /* true if connection closed by close_notify */
   bool recv_connection_closed; /* true if connection closed, regardless how */
   bool use_alpn; /* true if ALPN is used for this connection */
+#ifdef HAS_MANUAL_VERIFY_API
   bool use_manual_cred_validation; /* true if manual cred validation is used */
+#endif
 };
 #endif /* EXPOSE_SCHANNEL_INTERNAL_STRUCTS */
 
diff --git a/lib/vtls/schannel_verify.c b/lib/vtls/schannel_verify.c
index db187dd6b..5a7092a21 100644
--- a/lib/vtls/schannel_verify.c
+++ b/lib/vtls/schannel_verify.c
@@ -30,14 +30,15 @@
 #include "curl_setup.h"
 
 #ifdef USE_SCHANNEL
-
-#define EXPOSE_SCHANNEL_INTERNAL_STRUCTS
-
 #ifndef USE_WINDOWS_SSPI
 #  error "Can't compile SCHANNEL support without SSPI."
 #endif
 
+#define EXPOSE_SCHANNEL_INTERNAL_STRUCTS
 #include "schannel.h"
+
+#ifdef HAS_MANUAL_VERIFY_API
+
 #include "vtls.h"
 #include "sendf.h"
 #include "strerror.h"
@@ -53,7 +54,7 @@
 #define BACKEND connssl->backend
 
 #define MAX_CAFILE_SIZE 1048576 /* 1 MiB */
-#define BEGIN_CERT "-----BEGIN CERTIFICATE-----\n"
+#define BEGIN_CERT "-----BEGIN CERTIFICATE-----"
 #define END_CERT "\n-----END CERTIFICATE-----"
 
 typedef struct {
@@ -71,6 +72,10 @@ typedef struct {
   HCERTSTORE hExclusiveTrustedPeople;
 } CERT_CHAIN_ENGINE_CONFIG_WIN7, *PCERT_CHAIN_ENGINE_CONFIG_WIN7;
 
+static int is_cr_or_lf(char c)
+{
+  return c == '\r' || c == '\n';
+}
 
 static CURLcode add_certs_to_store(HCERTSTORE trust_store,
                                    const char *ca_file,
@@ -177,7 +182,7 @@ static CURLcode add_certs_to_store(HCERTSTORE trust_store,
   current_ca_file_ptr = ca_file_buffer;
   while(more_certs && *current_ca_file_ptr != '\0') {
     char *begin_cert_ptr = strstr(current_ca_file_ptr, BEGIN_CERT);
-    if(!begin_cert_ptr) {
+    if(!begin_cert_ptr || !is_cr_or_lf(begin_cert_ptr[strlen(BEGIN_CERT)])) {
       more_certs = 0;
     }
     else {
@@ -209,7 +214,7 @@ static CURLcode add_certs_to_store(HCERTSTORE trust_store,
                              NULL,
                              NULL,
                              NULL,
-                             &cert_context)) {
+                             (const void **)&cert_context)) {
 
           failf(data,
                 "schannel: failed to extract certificate from CA file "
@@ -548,4 +553,5 @@ CURLcode verify_certificate(struct connectdata *conn, int 
sockindex)
   return result;
 }
 
+#endif /* HAS_MANUAL_VERIFY_API */
 #endif /* USE_SCHANNEL */
diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
index ee5bc7a0a..bf96518bc 100644
--- a/lib/vtls/vtls.c
+++ b/lib/vtls/vtls.c
@@ -980,6 +980,14 @@ bool Curl_ssl_false_start(void)
 }
 
 /*
+ * Check whether the SSL backend supports setting TLS 1.3 cipher suites
+ */
+bool Curl_ssl_tls13_ciphersuites(void)
+{
+  return Curl_ssl->supports & SSLSUPP_TLS13_CIPHERSUITES;
+}
+
+/*
  * Default implementations for unsupported functions.
  */
 
diff --git a/lib/vtls/vtls.h b/lib/vtls/vtls.h
index e7b87c4d3..40f9d7479 100644
--- a/lib/vtls/vtls.h
+++ b/lib/vtls/vtls.h
@@ -31,6 +31,7 @@ struct ssl_connect_data;
 #define SSLSUPP_PINNEDPUBKEY (1<<2) /* supports CURLOPT_PINNEDPUBLICKEY */
 #define SSLSUPP_SSL_CTX      (1<<3) /* supports CURLOPT_SSL_CTX */
 #define SSLSUPP_HTTPS_PROXY  (1<<4) /* supports access via HTTPS proxies */
+#define SSLSUPP_TLS13_CIPHERSUITES (1<<5) /* supports TLS 1.3 ciphersuites */
 
 struct Curl_ssl {
   /*
@@ -93,6 +94,7 @@ CURLcode Curl_none_set_engine(struct Curl_easy *data, const 
char *engine);
 CURLcode Curl_none_set_engine_default(struct Curl_easy *data);
 struct curl_slist *Curl_none_engines_list(struct Curl_easy *data);
 bool Curl_none_false_start(void);
+bool Curl_ssl_tls13_ciphersuites(void);
 CURLcode Curl_none_md5sum(unsigned char *input, size_t inputlen,
                           unsigned char *md5sum, size_t md5len);
 
@@ -246,7 +248,7 @@ bool Curl_ssl_false_start(void);
 
 #define SSL_SHUTDOWN_TIMEOUT 10000 /* ms */
 
-#else
+#else /* if not USE_SSL */
 
 /* When SSL support is not present, just define away these function calls */
 #define Curl_ssl_init() 1
@@ -270,6 +272,7 @@ bool Curl_ssl_false_start(void);
 #define Curl_ssl_random(x,y,z) ((void)x, CURLE_NOT_BUILT_IN)
 #define Curl_ssl_cert_status_request() FALSE
 #define Curl_ssl_false_start() FALSE
+#define Curl_ssl_tls13_ciphersuites() FALSE
 #endif
 
 #endif /* HEADER_CURL_VTLS_H */
diff --git a/lib/x509asn1.c b/lib/x509asn1.c
index aabf6e8c7..f4f172a53 100644
--- a/lib/x509asn1.c
+++ b/lib/x509asn1.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2016, Daniel Stenberg, <address@hidden>, et al.
+ * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -712,7 +712,7 @@ int Curl_parseX509(curl_X509certificate *cert,
   /* Get optional version, get serialNumber. */
   cert->version.header = NULL;
   cert->version.beg = &defaultVersion;
-  cert->version.end = &defaultVersion + sizeof defaultVersion;;
+  cert->version.end = &defaultVersion + sizeof(defaultVersion);
   beg = Curl_getASN1Element(&elem, beg, end);
   if(elem.tag == 0) {
     Curl_getASN1Element(&cert->version, elem.beg, elem.end);
diff --git a/m4/ax_compile_check_sizeof.m4 b/m4/ax_compile_check_sizeof.m4
new file mode 100644
index 000000000..5705508a3
--- /dev/null
+++ b/m4/ax_compile_check_sizeof.m4
@@ -0,0 +1,115 @@
+# ============================================================================
+#  https://www.gnu.org/software/autoconf-archive/ax_compile_check_sizeof.html
+# ============================================================================
+#
+# SYNOPSIS
+#
+#   AX_COMPILE_CHECK_SIZEOF(TYPE [, HEADERS [, EXTRA_SIZES...]])
+#
+# DESCRIPTION
+#
+#   This macro checks for the size of TYPE using compile checks, not run
+#   checks. You can supply extra HEADERS to look into. the check will cycle
+#   through 1 2 4 8 16 and any EXTRA_SIZES the user supplies. If a match is
+#   found, it will #define SIZEOF_`TYPE' to that value. Otherwise it will
+#   emit a configure time error indicating the size of the type could not be
+#   determined.
+#
+#   The trick is that C will not allow duplicate case labels. While this is
+#   valid C code:
+#
+#     switch (0) case 0: case 1:;
+#
+#   The following is not:
+#
+#     switch (0) case 0: case 0:;
+#
+#   Thus, the AC_TRY_COMPILE will fail if the currently tried size does not
+#   match.
+#
+#   Here is an example skeleton configure.in script, demonstrating the
+#   macro's usage:
+#
+#     AC_PROG_CC
+#     AC_CHECK_HEADERS(stddef.h unistd.h)
+#     AC_TYPE_SIZE_T
+#     AC_CHECK_TYPE(ssize_t, int)
+#
+#     headers='#ifdef HAVE_STDDEF_H
+#     #include <stddef.h>
+#     #endif
+#     #ifdef HAVE_UNISTD_H
+#     #include <unistd.h>
+#     #endif
+#     '
+#
+#     AX_COMPILE_CHECK_SIZEOF(char)
+#     AX_COMPILE_CHECK_SIZEOF(short)
+#     AX_COMPILE_CHECK_SIZEOF(int)
+#     AX_COMPILE_CHECK_SIZEOF(long)
+#     AX_COMPILE_CHECK_SIZEOF(unsigned char *)
+#     AX_COMPILE_CHECK_SIZEOF(void *)
+#     AX_COMPILE_CHECK_SIZEOF(size_t, $headers)
+#     AX_COMPILE_CHECK_SIZEOF(ssize_t, $headers)
+#     AX_COMPILE_CHECK_SIZEOF(ptrdiff_t, $headers)
+#     AX_COMPILE_CHECK_SIZEOF(off_t, $headers)
+#
+# LICENSE
+#
+#   Copyright (c) 2008 Kaveh Ghazi <address@hidden>
+#   Copyright (c) 2017 Reini Urban <address@hidden>
+#
+#   This program is free software: you can redistribute it and/or modify it
+#   under the terms of the GNU General Public License as published by the
+#   Free Software Foundation, either version 3 of the License, or (at your
+#   option) any later version.
+#
+#   This program is distributed in the hope that it will be useful, but
+#   WITHOUT ANY WARRANTY; without even the implied warranty of
+#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
+#   Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License along
+#   with this program. If not, see <https://www.gnu.org/licenses/>.
+#
+#   As a special exception, the respective Autoconf Macro's copyright owner
+#   gives unlimited permission to copy, distribute and modify the configure
+#   scripts that are the output of Autoconf when processing the Macro. You
+#   need not follow the terms of the GNU General Public License when using
+#   or distributing such scripts, even though portions of the text of the
+#   Macro appear in them. The GNU General Public License (GPL) does govern
+#   all other use of the material that constitutes the Autoconf Macro.
+#
+#   This special exception to the GPL applies to versions of the Autoconf
+#   Macro released by the Autoconf Archive. When you make and distribute a
+#   modified version of the Autoconf Macro, you may extend this special
+#   exception to the GPL to apply to your modified version as well.
+
+#serial 7
+
+AU_ALIAS([AC_COMPILE_CHECK_SIZEOF], [AX_COMPILE_CHECK_SIZEOF])
+AC_DEFUN([AX_COMPILE_CHECK_SIZEOF],
+[changequote(<<, >>)dnl
+dnl The name to #define.
+define(<<AC_TYPE_NAME>>, translit(sizeof_$1, [a-z *], [A-Z_P]))dnl
+dnl The cache variable name.
+define(<<AC_CV_NAME>>, translit(ac_cv_sizeof_$1, [ *], [_p]))dnl
+changequote([, ])dnl
+AC_MSG_CHECKING(size of $1)
+AC_CACHE_VAL(AC_CV_NAME,
+[for ac_size in 4 8 1 2 16 $3 ; do # List sizes in rough order of prevalence.
+  AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
+#include <sys/types.h>
+$2
+]], [[switch (0) case 0: case (sizeof ($1) == $ac_size):;]])], 
[AC_CV_NAME=$ac_size])
+  if test x$AC_CV_NAME != x ; then break; fi
+done
+])
+if test x$AC_CV_NAME = x ; then
+  AC_MSG_ERROR([cannot determine a size for $1])
+fi
+AC_MSG_RESULT($AC_CV_NAME)
+AC_DEFINE_UNQUOTED(AC_TYPE_NAME, $AC_CV_NAME, [The number of bytes in type $1])
+undefine([AC_TYPE_NAME])dnl
+undefine([AC_CV_NAME])dnl
+])
diff --git a/m4/curl-confopts.m4 b/m4/curl-confopts.m4
index ad6acd8f0..e591caa58 100644
--- a/m4/curl-confopts.m4
+++ b/m4/curl-confopts.m4
@@ -5,7 +5,7 @@
 #                            | (__| |_| |  _ <| |___
 #                             \___|\___/|_| \_\_____|
 #
-# Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+# Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
 #
 # This software is licensed as described in the file COPYING, which
 # you should have received as part of this distribution. The terms
@@ -497,9 +497,24 @@ AC_DEFUN([CURL_CHECK_LIB_ARES], [
     embedded_ares_builddir="$configure_runpath/ares"
     if test -n "$want_ares_path"; then
       dnl c-ares library path has been specified
-      ares_CPPFLAGS="-I$want_ares_path/include"
-      ares_LDFLAGS="-L$want_ares_path/lib"
-      ares_LIBS="-lcares"
+      ARES_PCDIR="$want_ares_path/lib/pkgconfig"
+      CURL_CHECK_PKGCONFIG(libcares, [$ARES_PCDIR])
+      if test "$PKGCONFIG" != "no" ; then
+        ares_LIBS=`CURL_EXPORT_PCDIR([$ARES_PCDIR])
+          $PKGCONFIG --libs-only-l libcares`
+        ares_LDFLAGS=`CURL_EXPORT_PCDIR([$ARES_PCDIR])
+          $PKGCONFIG --libs-only-L libcares`
+        ares_CPPFLAGS=`CURL_EXPORT_PCDIR([$ARES_PCDIR])
+          $PKGCONFIG --cflags-only-I libcares`
+        AC_MSG_NOTICE([pkg-config: ares LIBS: "$ares_LIBS"])
+        AC_MSG_NOTICE([pkg-config: ares LDFLAGS: "$ares_LDFLAGS"])
+        AC_MSG_NOTICE([pkg-config: ares CPPFLAGS: "$ares_CPPFLAGS"])
+      else
+        dnl ... path without pkg-config
+        ares_CPPFLAGS="-I$want_ares_path/include"
+        ares_LDFLAGS="-L$want_ares_path/lib"
+        ares_LIBS="-lcares"
+      fi
     else
       dnl c-ares library path has not been given
       if test -d "$srcdir/ares"; then
@@ -513,9 +528,19 @@ AC_DEFUN([CURL_CHECK_LIB_ARES], [
         ares_LIBS="-lcares"
       else
         dnl c-ares path not specified, use defaults
-        ares_CPPFLAGS=""
-        ares_LDFLAGS=""
-        ares_LIBS="-lcares"
+        CURL_CHECK_PKGCONFIG(libcares)
+        if test "$PKGCONFIG" != "no" ; then
+          ares_LIBS=`$PKGCONFIG --libs-only-l libcares`
+          ares_LDFLAGS=`$PKGCONFIG --libs-only-L libcares`
+          ares_CPPFLAGS=`$PKGCONFIG --cflags-only-I libcares`
+          AC_MSG_NOTICE([pkg-config: ares_LIBS: "$ares_LIBS"])
+          AC_MSG_NOTICE([pkg-config: ares_LDFLAGS: "$ares_LDFLAGS"])
+          AC_MSG_NOTICE([pkg-config: ares_CPPFLAGS: "$ares_CPPFLAGS"])
+        else
+          ares_CPPFLAGS=""
+          ares_LDFLAGS=""
+          ares_LIBS="-lcares"
+        fi
       fi
     fi
     #
diff --git a/m4/curl-functions.m4 b/m4/curl-functions.m4
index 1bbde9ed5..49b4c7932 100644
--- a/m4/curl-functions.m4
+++ b/m4/curl-functions.m4
@@ -7020,7 +7020,8 @@ AC_DEFUN([CURL_RUN_IFELSE], [
    AC_REQUIRE([AC_RUN_IFELSE])dnl
 
    old=$LD_LIBRARY_PATH
-   LD_LIBRARY_PATH=$CURL_LIBRARY_PATH
+   LD_LIBRARY_PATH=$CURL_LIBRARY_PATH:$old
+   export LD_LIBRARY_PATH
    AC_RUN_IFELSE([AC_LANG_SOURCE([$1])], $2, $3, $4)
    LD_LIBRARY_PATH=$old # restore
 ])
diff --git a/maketgz b/maketgz
index 03e4fdb61..07fa9d5fa 100755
--- a/maketgz
+++ b/maketgz
@@ -1,4 +1,4 @@
-#! /bin/sh
+#!/bin/sh
 # Script to build release-archives with. Note that this requires a checkout
 # from git and you should first run ./buildconf and build curl once.
 #
@@ -9,7 +9,7 @@
 #                            | (__| |_| |  _ <| |___
 #                             \___|\___/|_| \_\_____|
 #
-# Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+# Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
 #
 # This software is licensed as described in the file COPYING, which
 # you should have received as part of this distribution. The terms
@@ -32,8 +32,8 @@ if [ -z "$version" ]; then
 fi
 
 if [ "xonly" = "x$2" ]; then
-    echo "Setup version number only!"
-    only=1
+  echo "Setup version number only!"
+  only=1
 fi
 
 libversion="$version"
@@ -41,13 +41,13 @@ libversion="$version"
 # we make curl the same version as libcurl
 curlversion=$libversion
 
-major=`echo $libversion |cut -d. -f1 | sed -e "s/[^0-9]//g"`
-minor=`echo $libversion |cut -d. -f2 | sed -e "s/[^0-9]//g"`
-patch=`echo $libversion |cut -d. -f3 | cut -d- -f1 | sed -e "s/[^0-9]//g"`
+major=`echo $libversion | cut -d. -f1 | sed -e "s/[^0-9]//g"`
+minor=`echo $libversion | cut -d. -f2 | sed -e "s/[^0-9]//g"`
+patch=`echo $libversion | cut -d. -f3 | cut -d- -f1 | sed -e "s/[^0-9]//g"`
 
 if test -z "$patch"; then
-    echo "invalid version number? needs to be z.y.z"
-    exit
+  echo "invalid version number? needs to be z.y.z"
+  exit
 fi
 
 #
@@ -64,37 +64,41 @@ CHEADER=src/tool_version.h
 PLIST=lib/libgnurl.plist
 
 if test -z "$only"; then
-    ext=".dist"
-    # when not setting up version numbers locally
-    for a in $HEADER $CHEADER $PLIST; do
-        cp $a "$a$ext"
-    done
-    HEADER="$HEADER$ext"
-    CHEADER="$CHEADER$ext"
-    PLIST="$PLIST$ext"
+  ext=".dist"
+  # when not setting up version numbers locally
+  for a in $HEADER $CHEADER $PLIST; do
+    cp $a "$a$ext"
+  done
+  HEADER="$HEADER$ext"
+  CHEADER="$CHEADER$ext"
+  PLIST="$PLIST$ext"
 fi
 
 # requires a date command that knows + for format
 datestamp=`date +"%F"`
 
 # Replace version number in header file:
-sed -i -e 's/^#define LIBCURL_VERSION .*/#define LIBCURL_VERSION 
"'$libversion'"/g' \
+sed -i.bak \
+    -e 's/^#define LIBCURL_VERSION .*/#define LIBCURL_VERSION 
"'$libversion'"/g' \
     -e 's/^#define LIBCURL_VERSION_NUM .*/#define LIBCURL_VERSION_NUM 
0x'$numeric'/g' \
     -e 's/^#define LIBCURL_VERSION_MAJOR .*/#define LIBCURL_VERSION_MAJOR 
'$major'/g' \
     -e 's/^#define LIBCURL_VERSION_MINOR .*/#define LIBCURL_VERSION_MINOR 
'$minor'/g' \
     -e 's/^#define LIBCURL_VERSION_PATCH .*/#define LIBCURL_VERSION_PATCH 
'$patch'/g' \
     -e "s/^#define LIBCURL_TIMESTAMP .*/#define LIBCURL_TIMESTAMP 
\"$datestamp\"/g" \
- $HEADER
+    $HEADER
+rm -f "$HEADER.bak"
 
 # Replace version number in header file:
-sed -i 's/#define CURL_VERSION .*/#define CURL_VERSION "'$curlversion'"/g' 
$CHEADER
+sed -i.bak 's/#define CURL_VERSION .*/#define CURL_VERSION "'$curlversion'"/g' 
$CHEADER
+rm -f "$CHEADER.bak"
 
 # Replace version number in plist file:
-sed -i "s/7\.12\.3/$libversion/g" $PLIST
+sed -i.bak "s/7\.12\.3/$libversion/g" $PLIST
+rm -f "$PLIST.bak"
 
 if test -n "$only"; then
-    # done!
-    exit;
+  # done!
+  exit;
 fi
 
 # Replace version number in plist file:
@@ -106,8 +110,7 @@ echo "libgnurl version $libversion"
 echo "libgnurl numerical $numeric"
 echo "datestamp $datestamp"
 
-findprog()
-{
+findprog() {
   file="$1"
   for part in `echo $PATH| tr ':' ' '`; do
     path="$part/$file"
@@ -175,6 +178,20 @@ makeZ() {
     mv $compress ../
     cd ..
     rm -rf $tempdir
+
+############################################################################
+#
+# Now make a zip archive from the tar.gz original
+#
+makezip() {
+  rm -rf $tempdir
+  mkdir $tempdir
+  cd $tempdir
+  gzip -dc ../$targz | tar -xf -
+  find . | zip $zip -@ >/dev/null
+  mv $zip ../
+  cd ..
+  rm -rf $tempdir
 }
 
 echo "Generating $compress"
diff --git a/packages/OS400/README.OS400 b/packages/OS400/README.OS400
index f92d11637..aaa8a3256 100644
--- a/packages/OS400/README.OS400
+++ b/packages/OS400/README.OS400
@@ -107,6 +107,7 @@ options:
         CURLOPT_PROXY_SSLKEY
         CURLOPT_PROXY_SSLKEYTYPE
         CURLOPT_PROXY_SSL_CIPHER_LIST
+        CURLOPT_PROXY_TLS13_CIPHERS
         CURLOPT_PROXY_TLSAUTH_PASSWORD
         CURLOPT_PROXY_TLSAUTH_TYPE
         CURLOPT_PROXY_TLSAUTH_USERNAME
@@ -129,6 +130,7 @@ options:
         CURLOPT_SSLKEY
         CURLOPT_SSLKEYTYPE
         CURLOPT_SSL_CIPHER_LIST
+        CURLOPT_TLS13_CIPHERS
         CURLOPT_TLSAUTH_PASSWORD
         CURLOPT_TLSAUTH_TYPE
         CURLOPT_TLSAUTH_USERNAME
@@ -318,8 +320,10 @@ _ Procedures curl_easy_setopt_long(), 
curl_easy_setopt_object(),
   curl_easy_setopt_function() and curl_easy_setopt_offset() are all alias
   prototypes to curl_easy_setopt(), but with different parameter lists.
 _ Procedures curl_easy_getinfo_string(), curl_easy_getinfo_long(),
-  curl_easy_getinfo_double() and curl_easy_getinfo_slist() are all alias
-  prototypes to curl_easy_getinfo(), but with different parameter lists.
+  curl_easy_getinfo_double(), curl_easy_getinfo_slist(),
+  curl_easy_getinfo_ptr(), curl_easy_getinfo_socket() and
+  curl_easy_getinfo_off_t() are all alias prototypes to curl_easy_getinfo(),
+  but with different parameter lists.
 _ Procedures curl_multi_setopt_long(), curl_multi_setopt_object(),
   curl_multi_setopt_function() and curl_multi_setopt_offset() are all alias
   prototypes to curl_multi_setopt(), but with different parameter lists.
diff --git a/packages/OS400/ccsidcurl.c b/packages/OS400/ccsidcurl.c
index 0ca6d6866..af53f6761 100644
--- a/packages/OS400/ccsidcurl.c
+++ b/packages/OS400/ccsidcurl.c
@@ -1179,6 +1179,7 @@ curl_easy_setopt_ccsid(CURL * curl, CURLoption tag, ...)
   case CURLOPT_PROXY_SSLKEY:
   case CURLOPT_PROXY_SSLKEYTYPE:
   case CURLOPT_PROXY_SSL_CIPHER_LIST:
+  case CURLOPT_PROXY_TLS13_CIPHERS:
   case CURLOPT_PROXY_TLSAUTH_PASSWORD:
   case CURLOPT_PROXY_TLSAUTH_TYPE:
   case CURLOPT_PROXY_TLSAUTH_USERNAME:
@@ -1201,6 +1202,7 @@ curl_easy_setopt_ccsid(CURL * curl, CURLoption tag, ...)
   case CURLOPT_SSLKEY:
   case CURLOPT_SSLKEYTYPE:
   case CURLOPT_SSL_CIPHER_LIST:
+  case CURLOPT_TLS13_CIPHERS:
   case CURLOPT_TLSAUTH_PASSWORD:
   case CURLOPT_TLSAUTH_TYPE:
   case CURLOPT_TLSAUTH_USERNAME:
@@ -1345,3 +1347,80 @@ curl_pushheader_byname_ccsid(struct curl_pushheaders *h, 
const char *header,
 
   return d;
 }
+
+static CURLcode
+mime_string_call(curl_mimepart *part, const char *string, unsigned int ccsid,
+                 CURLcode (*mimefunc)(curl_mimepart *part, const char *string))
+
+{
+  char *s = (char *) NULL;
+  CURLcode result;
+
+  if(!string)
+    return mimefunc(part, string);
+  s = dynconvert(ASCII_CCSID, string, -1, ccsid);
+  if(!s)
+    return CURLE_OUT_OF_MEMORY;
+
+  result = mimefunc(part, s);
+  free(s);
+  return result;
+}
+
+CURLcode
+curl_mime_name_ccsid(curl_mimepart *part, const char *name, unsigned int ccsid)
+
+{
+  return mime_string_call(part, name, ccsid, curl_mime_name);
+}
+
+CURLcode
+curl_mime_filename_ccsid(curl_mimepart *part,
+                         const char *filename, unsigned int ccsid)
+
+{
+  return mime_string_call(part, filename, ccsid, curl_mime_filename);
+}
+
+CURLcode
+curl_mime_type_ccsid(curl_mimepart *part,
+                     const char *mimetype, unsigned int ccsid)
+
+{
+  return mime_string_call(part, mimetype, ccsid, curl_mime_type);
+}
+
+CURLcode
+curl_mime_encoder_ccsid(curl_mimepart *part,
+                       const char *encoding, unsigned int ccsid)
+
+{
+  return mime_string_call(part, encoding, ccsid, curl_mime_encoder);
+}
+
+CURLcode
+curl_mime_filedata_ccsid(curl_mimepart *part,
+                         const char *filename, unsigned int ccsid)
+
+{
+  return mime_string_call(part, filename, ccsid, curl_mime_filedata);
+}
+
+CURLcode
+curl_mime_data_ccsid(curl_mimepart *part,
+                     const char *data, size_t datasize, unsigned int ccsid)
+
+{
+  char *s = (char *) NULL;
+  CURLcode result;
+
+  if(!data)
+    return curl_mime_data(part, data, datasize);
+  s = dynconvert(ASCII_CCSID, data, datasize, ccsid);
+  if(!s)
+    return CURLE_OUT_OF_MEMORY;
+
+  result = curl_mime_data(part, s, datasize);
+  free(s);
+  return result;
+}
diff --git a/packages/OS400/ccsidcurl.h b/packages/OS400/ccsidcurl.h
index 5bd24cf36..a65dfbc2a 100644
--- a/packages/OS400/ccsidcurl.h
+++ b/packages/OS400/ccsidcurl.h
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2013, Daniel Stenberg, <address@hidden>, et al.
+ * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -67,5 +67,23 @@ CURL_EXTERN char *curl_pushheader_byname_ccsid(struct 
curl_pushheaders *h,
                                                const char *header,
                                                unsigned int ccsidin,
                                                unsigned int ccsidout);
+CURL_EXTERN CURLcode curl_mime_name_ccsid(curl_mimepart *part,
+                                          const char *name,
+                                          unsigned int ccsid);
+CURL_EXTERN CURLcode curl_mime_filename_ccsid(curl_mimepart *part,
+                                              const char *filename,
+                                              unsigned int ccsid);
+CURL_EXTERN CURLcode curl_mime_type_ccsid(curl_mimepart *part,
+                                          const char *mimetype,
+                                          unsigned int ccsid);
+CURL_EXTERN CURLcode curl_mime_encoder_ccsid(curl_mimepart *part,
+                                             const char *encoding,
+                                             unsigned int ccsid);
+CURL_EXTERN CURLcode curl_mime_filedata_ccsid(curl_mimepart *part,
+                                              const char *filename,
+                                              unsigned int ccsid);
+CURL_EXTERN CURLcode curl_mime_data_ccsid(curl_mimepart *part,
+                                          const char *data, size_t datasize,
+                                          unsigned int ccsid);
 
 #endif
diff --git a/packages/OS400/curl.inc.in b/packages/OS400/curl.inc.in
index b2ff6d6fb..8b150ed88 100644
--- a/packages/OS400/curl.inc.in
+++ b/packages/OS400/curl.inc.in
@@ -66,8 +66,11 @@
      d CURLINFO_DOUBLE...
      d                 c                   X'00300000'
      d CURLINFO_SLIST  c                   X'00400000'
+     d CURLINFO_PTR    c                   X'00400000'
      d CURLINFO_SOCKET...
      d                 c                   X'00500000'
+     d CURLINFO_OFF_T...
+     d                 c                   X'00600000'
      d CURLINFO_MASK   c                   X'000FFFFF'
      d CURLINFO_TYPEMASK...
      d                 c                   X'00F00000'
@@ -175,6 +178,8 @@
      d                 c                   X'00000010'
      d CURLAUTH_NTLM_WB...
      d                 c                   X'00000020'
+     d CURLAUTH_BEARER...
+     d                 c                   X'00000040'
      d CURLAUTH_ONLY...
      d                 c                   X'80000000'
      d CURLAUTH_ANY    c                   X'7FFFFFEF'
@@ -291,6 +296,9 @@
      d CURL_REDIR_POST_ALL...
      d                 c                   7
       *
+     d CURL_ZERO_TERMINATED...
+     d                 c                   -1
+      *
      d CURL_POLL_NONE  c                   0
      d CURL_POLL_IN    c                   1
      d CURL_POLL_OUT   c                   2
@@ -1334,6 +1342,12 @@
      d                 c                   00274
      d  CURLOPT_DNS_SHUFFLE_ADDRESSES...
      d                 c                   00275
+     d  CURLOPT_TLS13_CIPHERS...
+     d                 c                   10276
+     d  CURLOPT_PROXY_TLS13_CIPHERS...
+     d                 c                   10277
+     d  CURLOPT_DISALLOW_USERNAME_IN_URL...
+     d                 c                   00278
       *
       /if not defined(CURL_NO_OLDIES)
      d  CURLOPT_FILE   c                   10001
@@ -1442,12 +1456,20 @@
      d                 c                   X'00300006'
      d  CURLINFO_SIZE_UPLOAD...                                                
 CURLINFO_DOUBLE + 7
      d                 c                   X'00300007'
+     d  CURLINFO_SIZE_UPLOAD_T...                                              
 CURLINFO_OFF_T  + 7
+     d                 c                   X'00600007'
      d  CURLINFO_SIZE_DOWNLOAD...                                              
 CURLINFO_DOUBLE + 8
      d                 c                   X'00300008'
+     d  CURLINFO_SIZE_DOWNLOAD_T...                                            
 CURLINFO_OFF_T  + 8
+     d                 c                   X'00600008'
      d  CURLINFO_SPEED_DOWNLOAD...                                             
 CURLINFO_DOUBLE + 9
      d                 c                   X'00300009'
+     d  CURLINFO_SPEED_DOWNLOAD_T...                                           
 CURLINFO_OFF_T  + 9
+     d                 c                   X'00600009'
      d  CURLINFO_SPEED_UPLOAD...                                               
 CURLINFO_DOUBLE + 10
      d                 c                   X'0030000A'
+     d  CURLINFO_SPEED_UPLOAD_T...                                             
 CURLINFO_OFF_T  + 10
+     d                 c                   X'0060000A'
      d  CURLINFO_HEADER_SIZE...                                                
 CURLINFO_LONG   + 11
      d                 c                   X'0020000B'
      d  CURLINFO_REQUEST_SIZE...                                               
 CURLINFO_LONG   + 12
@@ -1456,10 +1478,16 @@
      d                 c                   X'0020000D'
      d  CURLINFO_FILETIME...                                                   
 CURLINFO_LONG   + 14
      d                 c                   X'0020000E'
+     d  CURLINFO_FILETIME_T...                                                 
 CURLINFO_OFF_T  + 14
+     d                 c                   X'0060000E'
      d  CURLINFO_CONTENT_LENGTH_DOWNLOAD...                                    
 CURLINFO_DOUBLE + 15
      d                 c                   X'0030000F'
+     d  CURLINFO_CONTENT_LENGTH_DOWNLOAD_T...                                  
 CURLINFO_OFF_T  + 15
+     d                 c                   X'0060000F'
      d  CURLINFO_CONTENT_LENGTH_UPLOAD...                                      
 CURLINFO_DOUBLE + 16
      d                 c                   X'00300010'
+     d  CURLINFO_CONTENT_LENGTH_UPLOAD_T...                                    
 CURLINFO_OFF_T  + 16
+     d                 c                   X'00600010'
      d  CURLINFO_STARTTRANSFER_TIME...                                         
 CURLINFO_DOUBLE + 17
      d                 c                   X'00300011'
      d  CURLINFO_CONTENT_TYPE...                                               
 CURLINFO_STRING + 18
@@ -1526,6 +1554,20 @@
      d                 c                   X'00200030'
      d  CURLINFO_SCHEME...                                                     
 CURLINFO_STRING + 49
      d                 c                   X'00100031'
+     d  CURLINFO_TOTAL_TIME_T...                                               
 CURLINFO_OFF_T  + 50
+     d                 c                   X'00600032'
+     d  CURLINFO_NAMELOOKUP_TIME_T...                                          
 CURLINFO_OFF_T  + 51
+     d                 c                   X'00600033'
+     d  CURLINFO_CONNECT_TIME_T...                                             
 CURLINFO_OFF_T  + 52
+     d                 c                   X'00600034'
+     d  CURLINFO_PRETRANSFER_TIME_T...                                         
 CURLINFO_OFF_T  + 53
+     d                 c                   X'00600035'
+     d  CURLINFO_STARTTRANSFER_TIME_T...                                       
 CURLINFO_OFF_T  + 54
+     d                 c                   X'00600036'
+     d  CURLINFO_REDIRECT_TIME_T...                                            
 CURLINFO_OFF_T  + 55
+     d                 c                   X'00600037'
+     d  CURLINFO_APPCONNECT_TIME_T...                                          
 CURLINFO_OFF_T  + 56
+     d                 c                   X'00600036'
       *
      d  CURLINFO_HTTP_CODE...                                                  
 Old ...RESPONSE_CODE
      d                 c                   X'00200002'
@@ -1591,8 +1633,10 @@
      d                 c                   4
      d  CURL_LOCK_DATA_CONNECT...
      d                 c                   5
-     d  CURL_LOCK_DATA_LAST...
+     d  CURL_LOCK_DATA_PSL...
      d                 c                   6
+     d  CURL_LOCK_DATA_LAST...
+     d                 c                   7
       *
      d curl_lock_access...
      d                 s             10i 0 based(######ptr######)              
 Enum
@@ -1979,6 +2023,74 @@
       *                              Prototypes
       
**************************************************************************
       *
+     d curl_mime_init  pr              *   extproc('curl_mime_init')           
 curl_mime *
+     d  easy                           *   value                               
 CURL *
+      *
+     d curl_mime_free  pr                  extproc('curl_mime_free')
+     d  mime                           *   value                               
 curl_mime *
+      *
+     d curl_mime_addpart...
+     d                 pr              *   extproc('curl_mime_addpart')        
 curl_mimepart *
+     d  mime                           *   value                               
 curl_mime *
+      *
+     d curl_mime_name  pr                  extproc('curl_mime_name')
+     d                                     like(CURLcode)
+     d  part                           *   value                               
 curl_mimepart *
+     d  name                           *   value options(*string)
+      *
+     d curl_mime_filename...
+     d                 pr                  extproc('curl_mime_filename')
+     d                                     like(CURLcode)
+     d  part                           *   value                               
 curl_mimepart *
+     d  filename                       *   value options(*string)
+      *
+     d curl_mime_type  pr                  extproc('curl_mime_type')
+     d                                     like(CURLcode)
+     d  part                           *   value                               
 curl_mimepart *
+     d  mimetype                       *   value options(*string)
+      *
+     d curl_mime_encoder...
+     d                 pr                  extproc('curl_mime_encoder')
+     d                                     like(CURLcode)
+     d  part                           *   value                               
 curl_mimepart *
+     d  encoding                       *   value options(*string)
+      *
+     d curl_mime_data  pr                  extproc('curl_mime_data')
+     d                                     like(CURLcode)
+     d  part                           *   value                               
 curl_mimepart *
+     d  data                           *   value options(*string)
+     d  datasize                     10u 0                                     
 size_t
+      *
+     d curl_mime_filedata...
+     d                 pr                  extproc('curl_mime_filedata')
+     d                                     like(CURLcode)
+     d  part                           *   value                               
 curl_mimepart *
+     d  filename                       *   value options(*string)
+      *
+     d curl_mime_data_cb...
+     d                 pr                  extproc('curl_mime_data_cb')
+     d                                     like(CURLcode)
+     d  part                           *   value                               
 curl_mimepart *
+     d  datasize                           value like(curl_off_t)
+     d  readfunc                           value like(curl_read_callback)
+     d  seekfunc                           value like(curl_seek_callback)
+     d  freefunc                           value like(curl_free_callback)
+     d  arg                            *   value                               
 void *
+      *
+     d curl_mime_subparts...
+     d                 pr                  extproc('curl_mime_subparts')
+     d                                     like(CURLcode)
+     d  part                           *   value                               
 curl_mimepart *
+     d  subparts                       *   value                               
 curl_mime *
+      *
+     d curl_mime_headers...
+     d                 pr                  extproc('curl_mime_headers')
+     d                                     like(CURLcode)
+     d  part                           *   value                               
 curl_mimepart *
+     d  headers                        *   value                               
 curl_slist *
+     d  take_ownership...
+     d                               10i 0 value
+      *
       *  This procedure as a variable parameter list.
       *  This prototype allows use of an option array, or a single "object"
       *    option. Other argument lists may be implemented by alias procedure
@@ -2188,6 +2300,27 @@
      d  info                               value like(CURLINFO)
      d  slistarg                       *   options(*nopass)                    
 struct curl_slist *
       *
+     d curl_easy_getinfo_ptr...
+     d                 pr                  extproc('curl_easy_getinfo')
+     d                                     like(CURLcode)
+     d  curl                           *   value                               
 CURL *
+     d  info                               value like(CURLINFO)
+     d  ptrarg                         *   options(*nopass)                    
 void *
+      *
+     d curl_easy_getinfo_socket...
+     d                 pr                  extproc('curl_easy_getinfo')
+     d                                     like(CURLcode)
+     d  curl                           *   value                               
 CURL *
+     d  info                               value like(CURLINFO)
+     d  socketarg                          like(curl_socket_t) options(*nopass)
+      *
+     d curl_easy_getinfo_off_t...
+     d                 pr                  extproc('curl_easy_getinfo')
+     d                                     like(CURLcode)
+     d  curl                           *   value                               
 CURL *
+     d  info                               value like(CURLINFO)
+     d  offsetarg                          like(curl_off_t) options(*nopass)
+      *
       *
      d curl_easy_duphandle...
      d                 pr              *   extproc('curl_easy_duphandle')      
 CURL *
@@ -2464,4 +2597,47 @@
      d  ccsidin                      10u 0 value
      d  ccsidout                     10u 0 value
       *
+     d curl_mime_name_ccsid...
+     d                 pr                  extproc('curl_mime_name_ccsid')
+     d                                     like(CURLcode)
+     d  part                           *   value                               
 curl_mimepart *
+     d  name                           *   value options(*string)
+     d  ccsid                        10u 0 value
+      *
+     d curl_mime_filename_ccsid...
+     d                 pr                  extproc('curl_mime_filename_ccsid')
+     d                                     like(CURLcode)
+     d  part                           *   value                               
 curl_mimepart *
+     d  filename                       *   value options(*string)
+     d  ccsid                        10u 0 value
+      *
+     d curl_mime_type_ccsid...
+     d                 pr                  extproc('curl_mime_type_ccsid')
+     d                                     like(CURLcode)
+     d  part                           *   value                               
 curl_mimepart *
+     d  mimetype                       *   value options(*string)
+     d  ccsid                        10u 0 value
+      *
+     d curl_mime_encoder_ccsid...
+     d                 pr                  extproc('curl_mime_encoder_ccsid')
+     d                                     like(CURLcode)
+     d  part                           *   value                               
 curl_mimepart *
+     d  encoding                       *   value options(*string)
+     d  ccsid                        10u 0 value
+      *
+     d curl_mime_data_ccsid...
+     d                 pr                  extproc('curl_mime_data_ccsid')
+     d                                     like(CURLcode)
+     d  part                           *   value                               
 curl_mimepart *
+     d  data                           *   value options(*string)
+     d  datasize                     10u 0                                     
 size_t
+     d  ccsid                        10u 0 value
+      *
+     d curl_mime_filedata_ccsid...
+     d                 pr                  extproc('curl_mime_filedata_ccsid')
+     d                                     like(CURLcode)
+     d  part                           *   value                               
 curl_mimepart *
+     d  filename                       *   value options(*string)
+     d  ccsid                        10u 0 value
+      *
       /endif
diff --git a/packages/OS400/os400sys.c b/packages/OS400/os400sys.c
index c80f01080..849f23973 100644
--- a/packages/OS400/os400sys.c
+++ b/packages/OS400/os400sys.c
@@ -23,7 +23,7 @@
 
 /* OS/400 additional support. */
 
-#include <curl/curl.h>
+#include <gnurl/curl.h>
 #include "config-os400.h"  /* Not curl_setup.h: we only need some defines. */
 
 #include <sys/types.h>
diff --git a/packages/vms/build_gnv_curl_pcsi_desc.com 
b/packages/vms/build_gnv_curl_pcsi_desc.com
index 3b4cd803f..fab2c823c 100644
--- a/packages/vms/build_gnv_curl_pcsi_desc.com
+++ b/packages/vms/build_gnv_curl_pcsi_desc.com
@@ -351,7 +351,7 @@ $           endif
 $       endif
 $   endif
 $!
-$!  Filenames with $ in them are VMS special and do not need to be lowercased.
+$!  Filenames with $ in them are VMS special and do not need to be lowercase.
 $!  --------------------------------------------------------------------------
 $   if f$locate("$", pathname) .lt. f$length(pathname) then goto inst_file_loop
 $!
diff --git a/packages/vms/setup_gnv_curl_build.com 
b/packages/vms/setup_gnv_curl_build.com
index beec733c3..09f22a22e 100644
--- a/packages/vms/setup_gnv_curl_build.com
+++ b/packages/vms/setup_gnv_curl_build.com
@@ -60,7 +60,7 @@ $!
 $! We want detailed build logs.
 $ clist = "/list/show=(expan,includ)"
 $!
-$! We want full symbol names in exact case.  Need a commmon
+$! We want full symbol names in exact case.  Need a common
 $! repository for all directories.
 $ cnames = "/names=(shortened,as_is)/repository=''base_dir'"
 $!
diff --git a/projects/build-openssl.bat b/projects/build-openssl.bat
index d337b219c..9fd49b780 100644
--- a/projects/build-openssl.bat
+++ b/projects/build-openssl.bat
@@ -156,7 +156,7 @@ rem 
***************************************************************************
   
   if not defined PERL_PATH (
        rem Check we have Perl in our path 
-       rem using !! below as %% was having \Microsoft was unexecpted error.
+       rem using !! below as %% was having \Microsoft was unexpected error.
        echo !PATH! | findstr /I /C:"\Perl" 1>nul
        if errorlevel 1 (
                rem It isn't so check we have it installed and set the path if 
it is
diff --git a/projects/wolfssl_options.h b/projects/wolfssl_options.h
index f6af47cab..1ca618f10 100644
--- a/projects/wolfssl_options.h
+++ b/projects/wolfssl_options.h
@@ -47,7 +47,7 @@ create the thread local storage and that could be a problem 
for LoadLibrary.
 Regarding the options that were added via C_EXTRA_FLAGS:
 
 FP_MAX_BITS=16384
-http://www.yassl.com/forums/topic423-cacertorgs-ca-cert-verify-failed-but-withdisablefastmath-it-works.html
+https://web.archive.org/web/20150218183550/www.yassl.com/forums/topic423-cacertorgs-ca-cert-verify-failed-but-withdisablefastmath-it-works.html
 "Since root.crt uses a 4096-bit RSA key, you'll need to increase the fastmath
 buffer size.  You can do this using the define:
 FP_MAX_BITS and setting it to 8192."
diff --git a/scripts/Makefile.am b/scripts/Makefile.am
index e9e97ef75..38824ed00 100644
--- a/scripts/Makefile.am
+++ b/scripts/Makefile.am
@@ -24,6 +24,8 @@ PERL = @PERL@
 
 ZSH_COMPLETION_FUNCTION_FILENAME = _gnurl
 
+CLEANFILES = $(ZSH_COMPLETION_FUNCTION_FILENAME)
+
 all-local: $(ZSH_COMPLETION_FUNCTION_FILENAME)
 
 $(ZSH_COMPLETION_FUNCTION_FILENAME): zsh.pl
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index 506713015..d75f47f17 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -70,10 +70,6 @@ target_link_libraries( ${EXE_NAME} libcurl ${CURL_LIBS})
 #SET_TARGET_PROPERTIES(${EXE_NAME} RUNTIME_OUTPUT_DIRECTORY "blah blah blah")
 #SET_TARGET_PROPERTIES(${EXE_NAME} LIBRARY_OUTPUT_DIRECTORY "blah blah blah")
 
-# Add the postfix to the executable since it is not added automatically as for 
modules and shared libraries
-set_target_properties(${EXE_NAME} PROPERTIES
-  DEBUG_POSTFIX "${CMAKE_DEBUG_POSTFIX}")
-
 #INCLUDE(ModuleInstall OPTIONAL)
 
 install(TARGETS ${EXE_NAME} EXPORT curl-target DESTINATION bin)
diff --git a/src/Makefile.am b/src/Makefile.am
index 3398f80c6..7d50c679a 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -5,7 +5,7 @@
 #                            | (__| |_| |  _ <| |___
 #                             \___|\___/|_| \_\_____|
 #
-# Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+# Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
 #
 # This software is licensed as described in the file COPYING, which
 # you should have received as part of this distribution. The terms
@@ -88,7 +88,7 @@ CLEANFILES = tool_hugehelp.c
 # embedded text.
 NROFF=env LC_ALL=C @NROFF@ @MANOPT@ # figured out by the configure script
 
-EXTRA_DIST = mkhelp.pl makefile.dj Makefile.b32                \
+EXTRA_DIST = mkhelp.pl makefile.dj                                     \
  Makefile.m32 macos/curl.mcp.xml.sit.hqx macos/MACINSTALL.TXT          \
  macos/src/curl_GUSIConfig.cpp macos/src/macos_main.cpp makefile.amiga \
  curl.rc Makefile.netware Makefile.inc Makefile.Watcom CMakeLists.txt
diff --git a/src/Makefile.b32 b/src/Makefile.b32
deleted file mode 100644
index 6bcdcd700..000000000
--- a/src/Makefile.b32
+++ /dev/null
@@ -1,154 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) 2000, Jaepil Kim, <address@hidden>.
-# Copyright (C) 2001 - 2015, Daniel Stenberg, <address@hidden>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.haxx.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-#***************************************************************************
-
-############################################################
-#
-#  Makefile.b32 - Borland's C++ Compiler 5.X
-#
-#  'BCCDIR' has to be set up to point to the base directory
-#  of the compiler, i.e. SET BCCDIR = c:\Borland\BCC55
-#
-############################################################
-
-!if "$(__MAKE__)" == ""
-!error __MAKE__ not defined. Use Borlands's MAKE to process this makefile.
-!endif
-
-# Borland's $(MAKEDIR) expands to the path where make.exe is located,
-# use this feature to define BCCDIR when user has not defined BCCDIR.
-!ifndef BCCDIR
-BCCDIR = $(MAKEDIR)\..
-!endif
-
-# Edit the path below to point to the base of your Zlib sources.
-!ifndef ZLIB_PATH
-ZLIB_PATH = ..\..\zlib-1.2.8
-!endif
-
-# Edit the path below to point to the base of your OpenSSL package.
-!ifndef OPENSSL_PATH
-OPENSSL_PATH = ..\..\openssl-1.0.2a
-!endif
-
-# Set program's name
-PROGNAME = curl.exe
-
-# Setup environment
-PP_CMD   = cpp32 -q -P-
-CC_CMD   = bcc32 -q -c
-LD       = bcc32
-RM       = del 2>NUL
-MKDIR    = md
-RMDIR    = rd /q 2>NUL
-COPY     = $(COMSPEC) /c copy /y
-
-CC_FLAGS = -5 -O2 -tWM -w -w-aus -w-ccc -w-dup -w-prc -w-pro -w-rch -w-sig 
-w-spa -w-inl -w-pia -w-pin -Dinline=__inline
-LDFLAGS  = -q -lq -lap
-
-SRCDIRS  = .;..\lib
-OBJDIR   = .\BCC_objs
-INCDIRS  = -I.;..\include;..\lib
-LINKLIB  = $(BCCDIR)\lib\cw32mt.lib $(BCCDIR)\lib\ws2_32.lib
-DEFINES  = -DNDEBUG -DWIN32
-
-!ifdef DYNAMIC
-LIBCURL_LIB = ..\lib\libgnurl_imp.lib
-!else
-LIBCURL_LIB = ..\lib\libgnurl.lib
-DEFINES = $(DEFINES) -DCURL_STATICLIB
-!endif
-
-# ZLIB support is enabled setting WITH_ZLIB=1
-!ifdef WITH_ZLIB
-DEFINES  = $(DEFINES) -DHAVE_LIBZ -DHAVE_ZLIB_H
-INCDIRS  = $(INCDIRS);$(ZLIB_PATH)
-LINKLIB  = $(LINKLIB) $(ZLIB_PATH)\zlib.lib
-!endif
-
-# SSL support is enabled setting WITH_SSL=1
-!ifdef WITH_SSL
-DEFINES  = $(DEFINES) -DUSE_OPENSSL
-INCDIRS  = $(INCDIRS);$(OPENSSL_PATH)\inc32;$(OPENSSL_PATH)\inc32\openssl
-LINKLIB  = $(LINKLIB) $(OPENSSL_PATH)\out32\ssleay32.lib 
$(OPENSSL_PATH)\out32\libeay32.lib
-!endif
-
-.autodepend
-
-.path.c   = $(SRCDIRS)
-.path.obj = $(OBJDIR)
-.path.int = $(OBJDIR)
-
-# Makefile.inc provides the CSOURCES and HHEADERS defines
-!include Makefile.inc
-
-CSOURCES = $(CURL_CFILES) $(CURLX_CFILES:../lib/=)
-OBJECTS  = $(CSOURCES:.c=.obj)
-PREPROCESSED = $(CSOURCES:.c=.int)
-
-# Borland's command line compiler (BCC32) version 5.5.1 integrated
-# preprocessor has a bug which results in silently generating wrong
-# definitions for libcurl macros such as CURL_OFF_T_C, on the other
-# hand Borland's command line preprocessor (CPP32) version 5.5.1 does
-# not have the bug and achieves proper results. In order to avoid the
-# silent bug we first preprocess source files and later compile the
-# preprocessed result.
-
-.c.obj:
-       @-$(RM) $(@R).int
-       $(PP_CMD) $(CC_FLAGS) $(INCDIRS) $(DEFINES) -o$(@R).int $(<)
-       $(CC_CMD) $(CC_FLAGS) -o$(@) $(@R).int
-
-all:   $(OBJDIR) tool_hugehelp $(PROGNAME)
-
-clean:
-       cd $(OBJDIR)
-       @-$(RM) $(OBJECTS)
-       @-$(RM) $(PREPROCESSED)
-       cd ..
-       @-$(RMDIR) $(OBJDIR)
-       @-$(RM) $(PROGNAME)
-       @-$(RM) curl.tds
-
-$(OBJDIR):
-       @-$(RMDIR) $(OBJDIR)
-       @-$(MKDIR) $(OBJDIR)
-
-!ifdef WITH_ZLIB
-tool_hugehelp: ..\docs\MANUAL ..\docs\curl.1 mkhelp.pl
-        groff -Tascii -man -P -c ../docs/curl.1 > tool_hugehelp.tmp
-        perl -w mkhelp.pl -c ../docs/MANUAL < tool_hugehelp.tmp > 
tool_hugehelp.c
-       @-$(RM) tool_hugehelp.tmp
-!else
-tool_hugehelp:
-       if exist ..\GIT-INFO $(COPY) tool_hugehelp.c.cvs tool_hugehelp.c
-!endif
-
-$(PROGNAME): $(OBJECTS) $(LIBCURL_LIB) $(LINKLIB)
-       @-$(RM) $(PROGNAME)
-       $(LD) $(LDFLAGS) -e$@ @&&!
-$(**: = ^
-)
-!
-
-
-# End of Makefile.b32
diff --git a/src/Makefile.m32 b/src/Makefile.m32
index 2dfa3ba22..9c2af8b35 100644
--- a/src/Makefile.m32
+++ b/src/Makefile.m32
@@ -5,7 +5,7 @@
 #                            | (__| |_| |  _ <| |___
 #                             \___|\___/|_| \_\_____|
 #
-# Copyright (C) 1999 - 2017, Daniel Stenberg, <address@hidden>, et al.
+# Copyright (C) 1999 - 2018, Daniel Stenberg, <address@hidden>, et al.
 #
 # This software is licensed as described in the file COPYING, which
 # you should have received as part of this distribution. The terms
@@ -107,7 +107,7 @@ CFLAGS      += -fno-strict-aliasing
 LDFLAGS        = $(CURL_LDFLAG_EXTRAS) $(CURL_LDFLAG_EXTRAS_EXE) -s
 AR     = $(CURL_AR)
 RC     = $(CROSSPREFIX)windres
-RCFLAGS        = --include-dir=$(PROOT)/include -O COFF
+RCFLAGS        = --include-dir=$(PROOT)/include -O COFF -DCURL_EMBED_MANIFEST
 STRIP  = $(CROSSPREFIX)strip -g
 
 # We may need these someday
diff --git a/src/Makefile.netware b/src/Makefile.netware
index 245c54780..87a3da03c 100644
--- a/src/Makefile.netware
+++ b/src/Makefile.netware
@@ -178,7 +178,7 @@ endif
        CFLAGS += -align 4
 else
        # PRELUDE = $(NDK_CLIB)/imports/clibpre.o
-       # to avoid the __init_* / __deinit_* whoes don't use prelude from NDK
+       # to avoid the __init_* / __deinit_* woes don't use prelude from NDK
        PRELUDE = "$(MWCW_PATH)/libraries/runtime/prelude.obj"
        # CFLAGS += -include "$(MWCW_PATH)/headers/nlm_clib_prefix.h"
        CFLAGS += -align 1
@@ -201,7 +201,7 @@ else
 endif
 else
        # PRELUDE = $(NDK_CLIB)/imports/clibpre.gcc.o
-       # to avoid the __init_* / __deinit_* whoes don't use prelude from NDK
+       # to avoid the __init_* / __deinit_* woes don't use prelude from NDK
        # http://www.gknw.net/development/mk_nlm/gcc_pre.zip
        PRELUDE = $(NDK_ROOT)/pre/prelude.o
        CFLAGS += -include $(NDKBASE)/nlmconv/genlm.h
diff --git a/src/curl.rc b/src/curl.rc
index 5f49d2236..d47f50635 100644
--- a/src/curl.rc
+++ b/src/curl.rc
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+ * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -61,3 +61,51 @@ BEGIN
     VALUE "Translation", 0x409, 1200
   END
 END
+
+/* Manifest */
+
+#if defined(CURL_EMBED_MANIFEST)
+
+/* String escaping rules:
+     https://msdn.microsoft.com/library/aa381050
+   Application Manifest doc, including the list of 'supportedOS Id's:
+     https://msdn.microsoft.com/library/aa374191 */
+
+#ifndef CREATEPROCESS_MANIFEST_RESOURCE_ID
+#define CREATEPROCESS_MANIFEST_RESOURCE_ID  1
+#endif
+#ifndef RT_MANIFEST
+#define RT_MANIFEST  24
+#endif
+
+#define _STR(macro)   _STR_(macro)
+#define _STR_(macro)  #macro
+
+CREATEPROCESS_MANIFEST_RESOURCE_ID RT_MANIFEST
+BEGIN
+  "<?xml version=""1.0"" encoding=""UTF-8"" standalone=""yes""?>"
+  "<assembly xmlns=""urn:schemas-microsoft-com:asm.v1"" 
manifestVersion=""1.0"">"
+    "<assemblyIdentity name=""The curl executable"" version="""
+      _STR(LIBCURL_VERSION_MAJOR) "."
+      _STR(LIBCURL_VERSION_MINOR) "."
+      _STR(LIBCURL_VERSION_PATCH) ".0"" type=""win32""/>"
+    "<compatibility xmlns=""urn:schemas-microsoft-com:compatibility.v1"">"
+      "<application>"
+        "<supportedOS Id=""{e2011457-1546-43c5-a5fe-008deee3d3f0}""/>"  /* 
Vista / Server 2008 */
+        "<supportedOS Id=""{35138b9a-5d96-4fbd-8e2d-a2440225f93a}""/>"  /* 7 / 
Server 2008 R2 */
+        "<supportedOS Id=""{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}""/>"  /* 8 / 
Server 2012 */
+        "<supportedOS Id=""{1f676c76-80e1-4239-95bb-83d0f6d0da78}""/>"  /* 8.1 
/ Server 2012 R2 */
+        "<supportedOS Id=""{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}""/>"  /* 10 
/ Server 2016 */
+      "</application>"
+    "</compatibility>"
+    "<trustInfo xmlns=""urn:schemas-microsoft-com:asm.v3"">"
+      "<security>"
+        "<requestedPrivileges>"
+          "<requestedExecutionLevel level=""asInvoker"" uiAccess=""false""/>"
+        "</requestedPrivileges>"
+      "</security>"
+    "</trustInfo>"
+  "</assembly>"
+END
+
+#endif
diff --git a/src/tool_cb_dbg.c b/src/tool_cb_dbg.c
index 16bfb4208..c2dd51b7c 100644
--- a/src/tool_cb_dbg.c
+++ b/src/tool_cb_dbg.c
@@ -50,15 +50,15 @@ int tool_debug_cb(CURL *handle, curl_infotype type,
   FILE *output = config->errors;
   const char *text;
   struct timeval tv;
-  struct tm *now;
   char timebuf[20];
   time_t secs;
-  static time_t epoch_offset;
-  static int    known_offset;
 
   (void)handle; /* not used */
 
   if(config->tracetime) {
+    struct tm *now;
+    static time_t epoch_offset;
+    static int    known_offset;
     tv = tvnow();
     if(!known_offset) {
       epoch_offset = time(NULL) - tv.tv_sec;
@@ -101,14 +101,14 @@ int tool_debug_cb(CURL *handle, curl_infotype type,
     static const char * const s_infotype[] = {
       "*", "<", ">", "{", "}", "{", "}"
     };
-    size_t i;
-    size_t st = 0;
     static bool newl = FALSE;
     static bool traced_data = FALSE;
 
     switch(type) {
     case CURLINFO_HEADER_OUT:
       if(size > 0) {
+        size_t st = 0;
+        size_t i;
         for(i = 0; i < size - 1; i++) {
           if(data[i] == '\n') { /* LF */
             if(!newl) {
diff --git a/src/tool_cb_hdr.c b/src/tool_cb_hdr.c
index 7f2181f40..88ce5e13b 100644
--- a/src/tool_cb_hdr.c
+++ b/src/tool_cb_hdr.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+ * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -31,11 +31,20 @@
 #include "tool_doswin.h"
 #include "tool_msgs.h"
 #include "tool_cb_hdr.h"
+#include "tool_cb_wrt.h"
 
 #include "memdebug.h" /* keep this as LAST include */
 
 static char *parse_filename(const char *ptr, size_t len);
 
+#ifdef WIN32
+#define BOLD
+#define BOLDOFF
+#else
+#define BOLD "\x1b[1m"
+#define BOLDOFF "\x1b[21m"
+#endif
+
 /*
 ** callback for CURLOPT_HEADERFUNCTION
 */
@@ -48,7 +57,7 @@ size_t tool_header_cb(char *ptr, size_t size, size_t nmemb, 
void *userdata)
   const char *str = ptr;
   const size_t cb = size * nmemb;
   const char *end = (char *)ptr + cb;
-  char *url = NULL;
+  long protocol = 0;
 
   /*
    * Once that libcurl has called back tool_header_cb() the returned value
@@ -88,12 +97,15 @@ size_t tool_header_cb(char *ptr, size_t size, size_t nmemb, 
void *userdata)
    * Content-Disposition header specifying a filename property.
    */
 
+  curl_easy_getinfo(outs->config->easy, CURLINFO_PROTOCOL, &protocol);
   if(hdrcbdata->honor_cd_filename &&
      (cb > 20) && checkprefix("Content-disposition:", str) &&
-     !curl_easy_getinfo(outs->config->easy, CURLINFO_EFFECTIVE_URL, &url) &&
-     url && (checkprefix("http://";, url) || checkprefix("https://";, url))) {
+     (protocol & (CURLPROTO_HTTPS|CURLPROTO_HTTP))) {
     const char *p = str + 20;
 
+    if(!outs->stream && !tool_create_output_file(outs, FALSE))
+      return failure;
+
     /* look for the 'filename=' parameter
        (encoded filenames (*=) are not supported) */
     for(;;) {
@@ -119,19 +131,49 @@ size_t tool_header_cb(char *ptr, size_t size, size_t 
nmemb, void *userdata)
       len = (ssize_t)cb - (p - str);
       filename = parse_filename(p, len);
       if(filename) {
-        outs->filename = filename;
-        outs->alloc_filename = TRUE;
+        if(outs->stream) {
+          /* already opened and possibly written to */
+          if(outs->fopened)
+            fclose(outs->stream);
+          outs->stream = NULL;
+
+          /* rename the initial file name to the new file name */
+          rename(outs->filename, filename);
+          if(outs->alloc_filename)
+            free(outs->filename);
+        }
         outs->is_cd_filename = TRUE;
         outs->s_isreg = TRUE;
         outs->fopened = FALSE;
-        outs->stream = NULL;
-        hdrcbdata->honor_cd_filename = FALSE;
-        break;
+        outs->filename = filename;
+        outs->alloc_filename = TRUE;
+        hdrcbdata->honor_cd_filename = FALSE; /* done now! */
+        if(!tool_create_output_file(outs, TRUE))
+          return failure;
       }
-      return failure;
+      break;
     }
   }
 
+  if(hdrcbdata->config->show_headers &&
+     (protocol & (CURLPROTO_HTTP|CURLPROTO_HTTPS|CURLPROTO_RTSP))) {
+    /* bold headers only happen for HTTP(S) and RTSP */
+    char *value = NULL;
+
+    if(!outs->stream && !tool_create_output_file(outs, FALSE))
+      return failure;
+
+    if(hdrcbdata->global->isatty && hdrcbdata->global->styled_output)
+      value = memchr(ptr, ':', cb);
+    if(value) {
+      size_t namelen = value - ptr;
+      fprintf(outs->stream, BOLD "%.*s" BOLDOFF ":", namelen, ptr);
+      fwrite(&value[1], cb - namelen - 1, 1, outs->stream);
+    }
+    else
+      /* not "handled", just show it */
+      fwrite(ptr, cb, 1, outs->stream);
+  }
   return cb;
 }
 
@@ -233,4 +275,3 @@ static char *parse_filename(const char *ptr, size_t len)
 
   return copy;
 }
-
diff --git a/src/tool_cb_hdr.h b/src/tool_cb_hdr.h
index 32032e980..e1b9a920e 100644
--- a/src/tool_cb_hdr.h
+++ b/src/tool_cb_hdr.h
@@ -7,7 +7,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2012, Daniel Stenberg, <address@hidden>, et al.
+ * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -39,6 +39,8 @@
  */
 
 struct HdrCbData {
+  struct GlobalConfig *global;
+  struct OperationConfig *config;
   struct OutStruct *outs;
   struct OutStruct *heads;
   bool honor_cd_filename;
diff --git a/src/tool_cb_prg.c b/src/tool_cb_prg.c
index 60a3804f9..3eb2c1255 100644
--- a/src/tool_cb_prg.c
+++ b/src/tool_cb_prg.c
@@ -113,12 +113,6 @@ int tool_progress_cb(void *clientp,
   /* The original progress-bar source code was written for curl by Lars Aas,
      and this new edition inherits some of his concepts. */
 
-  char line[MAX_BARLENGTH + 1];
-  char format[40];
-  double frac;
-  double percent;
-  int barwidth;
-  int num;
   struct timeval now = tvnow();
   struct ProgressData *bar = (struct ProgressData *)clientp;
   curl_off_t total;
@@ -154,6 +148,12 @@ int tool_progress_cb(void *clientp,
   bar->calls++;
 
   if((total > 0) && (point != bar->prev)) {
+    char line[MAX_BARLENGTH + 1];
+    char format[40];
+    double frac;
+    double percent;
+    int barwidth;
+    int num;
     if(point > total)
       /* we have got more than the expected total! */
       total = point;
diff --git a/src/tool_cb_wrt.c b/src/tool_cb_wrt.c
index 6716ba5cd..476fef9a4 100644
--- a/src/tool_cb_wrt.c
+++ b/src/tool_cb_wrt.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+ * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -32,7 +32,8 @@
 #include "memdebug.h" /* keep this as LAST include */
 
 /* create a local file for writing, return TRUE on success */
-bool tool_create_output_file(struct OutStruct *outs)
+bool tool_create_output_file(struct OutStruct *outs,
+                             bool append)
 {
   struct GlobalConfig *global = outs->config->global;
   FILE *file;
@@ -42,7 +43,7 @@ bool tool_create_output_file(struct OutStruct *outs)
     return FALSE;
   }
 
-  if(outs->is_cd_filename) {
+  if(outs->is_cd_filename && !append) {
     /* don't overwrite existing files */
     file = fopen(outs->filename, "rb");
     if(file) {
@@ -54,7 +55,7 @@ bool tool_create_output_file(struct OutStruct *outs)
   }
 
   /* open file for writing */
-  file = fopen(outs->filename, "wb");
+  file = fopen(outs->filename, append?"ab":"wb");
   if(!file) {
     warnf(global, "Failed to create the file %s: %s\n", outs->filename,
           strerror(errno));
@@ -97,7 +98,7 @@ size_t tool_write_cb(char *buffer, size_t sz, size_t nmemb, 
void *userdata)
     }
   }
 
-  if(config->include_headers) {
+  if(config->show_headers) {
     if(bytes > (size_t)CURL_MAX_HTTP_HEADER) {
       warnf(config->global, "Header data size exceeds single call write "
             "limit!\n");
@@ -141,7 +142,7 @@ size_t tool_write_cb(char *buffer, size_t sz, size_t nmemb, 
void *userdata)
   }
 #endif
 
-  if(!outs->stream && !tool_create_output_file(outs))
+  if(!outs->stream && !tool_create_output_file(outs, FALSE))
     return failure;
 
   if(is_tty && (outs->bytes < 2000) && !config->terminal_binary_ok) {
diff --git a/src/tool_cb_wrt.h b/src/tool_cb_wrt.h
index 4ccbf3a5f..2b6e98ae4 100644
--- a/src/tool_cb_wrt.h
+++ b/src/tool_cb_wrt.h
@@ -7,7 +7,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2012, Daniel Stenberg, <address@hidden>, et al.
+ * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -30,7 +30,7 @@
 size_t tool_write_cb(char *buffer, size_t sz, size_t nmemb, void *userdata);
 
 /* create a local file for writing, return TRUE on success */
-bool tool_create_output_file(struct OutStruct *outs);
+bool tool_create_output_file(struct OutStruct *outs, bool append);
 
 #endif /* HEADER_CURL_TOOL_CB_WRT_H */
 
diff --git a/src/tool_cfgable.h b/src/tool_cfgable.h
index 9abaa9d39..a0363e9a7 100644
--- a/src/tool_cfgable.h
+++ b/src/tool_cfgable.h
@@ -100,7 +100,7 @@ struct OperationConfig {
   bool use_ascii;           /* select ascii or text transfer */
   bool autoreferer;         /* automatically set referer */
   bool failonerror;         /* fail on (HTTP) errors */
-  bool include_headers;     /* send headers to data output */
+  bool show_headers;        /* show headers to data output */
   bool no_body;             /* don't get the body */
   bool dirlistonly;         /* only get the FTP dir list */
   bool followlocation;      /* follow http redirects */
@@ -117,6 +117,8 @@ struct OperationConfig {
   struct getout *url_ul;    /* point to the node to fill in upload */
   char *cipher_list;
   char *proxy_cipher_list;
+  char *cipher13_list;
+  char *proxy_cipher13_list;
   char *cert;
   char *proxy_cert;
   char *cert_type;
@@ -252,7 +254,8 @@ struct OperationConfig {
   bool ssh_compression;           /* enable/disable SSH compression */
   long happy_eyeballs_timeout_ms; /* happy eyeballs timeout in milliseconds.
                                      0 is valid. default: CURL_HET_DEFAULT. */
-  bool haproxy_protocol;          /* whether to send HAProxy PROXY protocol */
+  bool haproxy_protocol;          /* whether to send HAProxy protocol v1 */
+  bool disallow_username_in_url;  /* disallow usernames in URLs */
   struct GlobalConfig *global;
   struct OperationConfig *prev;
   struct OperationConfig *next;   /* Always last in the struct */
@@ -276,6 +279,7 @@ struct GlobalConfig {
   int progressmode;               /* CURL_PROGRESS_BAR / CURL_PROGRESS_STATS */
   char *libcurl;                  /* Output libcurl code to this file name */
   bool fail_early;                /* exit on first transfer error */
+  bool styled_output;             /* enable fancy output style detection */
   struct OperationConfig *first;
   struct OperationConfig *current;
   struct OperationConfig *last;   /* Always last in the struct */
diff --git a/src/tool_formparse.c b/src/tool_formparse.c
index 5313b3441..5d1ea9c53 100644
--- a/src/tool_formparse.c
+++ b/src/tool_formparse.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+ * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -123,13 +123,12 @@ static int read_field_headers(struct OperationConfig 
*config,
 {
   size_t hdrlen = 0;
   size_t pos = 0;
-  int c;
   bool incomment = FALSE;
   int lineno = 1;
   char hdrbuf[999]; /* Max. header length + 1. */
 
   for(;;) {
-    c = getc(fp);
+    int c = getc(fp);
     if(c == EOF || (!pos && !ISSPACE(c))) {
       /* Strip and flush the current header. */
       while(hdrlen && ISSPACE(hdrbuf[hdrlen - 1]))
@@ -168,12 +167,12 @@ static int read_field_headers(struct OperationConfig 
*config,
 
     pos++;
     if(!incomment) {
-      if(hdrlen == sizeof hdrbuf - 1) {
+      if(hdrlen == sizeof(hdrbuf) - 1) {
         warnf(config->global, "File %s line %d: header too long (truncated)\n",
               filename, lineno);
         c = ' ';
       }
-      if(hdrlen <= sizeof hdrbuf - 1)
+      if(hdrlen <= sizeof(hdrbuf) - 1)
         hdrbuf[hdrlen++] = (char) c;
     }
   }
@@ -451,7 +450,7 @@ static CURLcode file_or_stdin(curl_mimepart *part, const 
char *file)
   if(strcmp(file, "-"))
     return curl_mime_filedata(part, file);
 
-  sip = (standard_input *) calloc(1, sizeof *sip);
+  sip = (standard_input *) calloc(1, sizeof(*sip));
   if(!sip)
     return CURLE_OUT_OF_MEMORY;
 
@@ -563,7 +562,6 @@ int formparse(struct OperationConfig *config,
   struct curl_slist *headers = NULL;
   curl_mimepart *part = NULL;
   CURLcode res;
-  int sep = '\0';
 
   /* Allocate the main mime structure if needed. */
   if(!*mimepost) {
@@ -585,6 +583,7 @@ int formparse(struct OperationConfig *config,
   /* Scan for the end of the name. */
   contp = strchr(contents, '=');
   if(contp) {
+    int sep = '\0';
     if(contp > contents)
       name = contents;
     *contp++ = '\0';
diff --git a/src/tool_getparam.c b/src/tool_getparam.c
index 19454c84a..cc3fcf3a5 100644
--- a/src/tool_getparam.c
+++ b/src/tool_getparam.c
@@ -82,6 +82,7 @@ static const struct LongShort aliases[]= {
   {"*d", "ciphers",                  ARG_STRING},
   {"*D", "dns-interface",            ARG_STRING},
   {"*e", "disable-epsv",             ARG_BOOL},
+  {"*f", "disallow-username-in-url", ARG_BOOL},
   {"*E", "epsv",                     ARG_BOOL},
          /* 'epsv' made like this to make --no-epsv and --epsv to work
              although --disable-epsv is the documented option */
@@ -201,6 +202,8 @@ static const struct LongShort aliases[]= {
   {"11",  "tlsv1.1",                 ARG_NONE},
   {"12",  "tlsv1.2",                 ARG_NONE},
   {"13",  "tlsv1.3",                 ARG_NONE},
+  {"1A", "tls13-ciphers",            ARG_STRING},
+  {"1B", "proxy-tls13-ciphers",      ARG_STRING},
   {"2",  "sslv2",                    ARG_NONE},
   {"3",  "sslv3",                    ARG_NONE},
   {"4",  "ipv4",                     ARG_NONE},
@@ -260,6 +263,7 @@ static const struct LongShort aliases[]= {
   {"EB", "socks5-gssapi",            ARG_BOOL},
   {"f",  "fail",                     ARG_BOOL},
   {"fa", "fail-early",               ARG_BOOL},
+  {"fb", "styled-output",            ARG_BOOL},
   {"F",  "form",                     ARG_STRING},
   {"Fs", "form-string",              ARG_STRING},
   {"g",  "globoff",                  ARG_BOOL},
@@ -502,8 +506,7 @@ ParameterError getparameter(const char *flag, /* f or 
-long-flag */
 
   *usedarg = FALSE; /* default is that we don't use the arg */
 
-  if(('-' != flag[0]) ||
-     (('-' == flag[0]) && ('-' == flag[1]))) {
+  if(('-' != flag[0]) || ('-' == flag[1])) {
     /* this should be a long name */
     const char *word = ('-' == flag[0]) ? flag + 2 : flag;
     size_t fnam = strlen(word);
@@ -600,6 +603,7 @@ ParameterError getparameter(const char *flag, /* f or 
-long-flag */
         break;
       case 'B': /* OAuth 2.0 bearer token */
         GetStr(&config->oauth_bearer, nextarg);
+        config->authtype |= CURLAUTH_BEARER;
         break;
       case 'c': /* connect-timeout */
         err = str2udouble(&config->connecttimeout, nextarg,
@@ -617,6 +621,9 @@ ParameterError getparameter(const char *flag, /* f or 
-long-flag */
       case 'e': /* --disable-epsv */
         config->disable_epsv = toggle;
         break;
+      case 'f': /* --disallow-username-in-url */
+        config->disallow_username_in_url = toggle;
+        break;
       case 'E': /* --epsv */
         config->disable_epsv = (!toggle)?TRUE:FALSE;
         break;
@@ -1175,6 +1182,12 @@ ParameterError getparameter(const char *flag, /* f or 
-long-flag */
         /* TLS version 1.3 */
         config->ssl_version = CURL_SSLVERSION_TLSv1_3;
         break;
+      case 'A': /* --tls13-ciphers */
+        GetStr(&config->cipher13_list, nextarg);
+        break;
+      case 'B': /* --proxy-tls13-ciphers */
+        GetStr(&config->proxy_cipher13_list, nextarg);
+        break;
       }
       break;
     case '2':
@@ -1643,8 +1656,10 @@ ParameterError getparameter(const char *flag, /* f or 
-long-flag */
       case 'a': /* --fail-early */
         global->fail_early = toggle;
         break;
-      default:
-        /* fail hard on errors  */
+      case 'b': /* --styled-output */
+        global->styled_output = toggle;
+        break;
+      default: /* --fail (hard on errors)  */
         config->failonerror = toggle;
       }
       break;
@@ -1722,24 +1737,22 @@ ParameterError getparameter(const char *flag, /* f or 
-long-flag */
       }
       break;
     case 'i':
-      config->include_headers = toggle; /* include the headers as well in the
-                                           general output stream */
+      config->show_headers = toggle; /* show the headers as well in the
+                                        general output stream */
       break;
     case 'j':
       config->cookiesession = toggle;
       break;
-    case 'I':
-      /*
-       * no_body will imply include_headers later on
-       */
+    case 'I': /* --head */
       config->no_body = toggle;
+      config->show_headers = toggle;
       if(SetHTTPrequest(config,
                         (config->no_body)?HTTPREQ_HEAD:HTTPREQ_GET,
                         &config->httpreq))
         return PARAM_BAD_USE;
       break;
     case 'J': /* --remote-header-name */
-      if(config->include_headers) {
+      if(config->show_headers) {
         warnf(global,
               "--include and --remote-header-name cannot be combined.\n");
         return PARAM_BAD_USE;
@@ -2141,7 +2154,6 @@ ParameterError parse_args(struct GlobalConfig *config, 
int argc,
     orig_opt = argv[i];
 
     if(stillflags && ('-' == argv[i][0])) {
-      char *nextarg;
       bool passarg;
       char *flag = argv[i];
 
@@ -2150,7 +2162,7 @@ ParameterError parse_args(struct GlobalConfig *config, 
int argc,
            following (URL) argument to start with -. */
         stillflags = FALSE;
       else {
-        nextarg = (i < (argc - 1)) ? argv[i + 1] : NULL;
+        char *nextarg = (i < (argc - 1)) ? argv[i + 1] : NULL;
 
         result = getparameter(flag, nextarg, &passarg, config, operation);
         if(result == PARAM_NEXT_OPERATION) {
diff --git a/src/tool_help.c b/src/tool_help.c
index 6f5ad08d4..b829e76ef 100644
--- a/src/tool_help.c
+++ b/src/tool_help.c
@@ -108,6 +108,8 @@ static const struct helptxt helptext[] = {
    "Inhibit using EPRT or LPRT"},
   {"    --disable-epsv",
    "Inhibit using EPSV"},
+  {"    --disallow-username-in-url",
+   "Disallow username in url"},
   {"    --dns-interface <interface>",
    "Interface to use for DNS requests"},
   {"    --dns-ipv4-addr <address>",
@@ -160,12 +162,12 @@ static const struct helptxt helptext[] = {
    "Put the post data in the URL and use GET"},
   {"-g, --globoff",
    "Disable URL sequences and ranges using {} and []"},
-  {"    --happy-eyeballs-timeout-ms",
+  {"    --happy-eyeballs-timeout-ms <milliseconds>",
    "How long to wait in milliseconds for IPv6 before trying IPv4"},
+  {"    --haproxy-protocol",
+   "Send HAProxy PROXY protocol v1 header"},
   {"-I, --head",
    "Show document info only"},
-  {"    --haproxy-protocol",
-   "Send HAProxy PROXY protocol header"},
   {"-H, --header <header/@file>",
    "Pass custom header(s) to server"},
   {"-h, --help",
@@ -297,7 +299,7 @@ static const struct helptxt helptext[] = {
   {"    --proxy-cert <cert[:passwd]>",
    "Set client certificate for proxy"},
   {"    --proxy-cert-type <type>",
-   "Client certificate type for HTTS proxy"},
+   "Client certificate type for HTTPS proxy"},
   {"    --proxy-ciphers <list>",
    "SSL ciphers to use for proxy"},
   {"    --proxy-crlfile <file>",
@@ -324,6 +326,8 @@ static const struct helptxt helptext[] = {
    "SPNEGO proxy service name"},
   {"    --proxy-ssl-allow-beast",
    "Allow security flaw for interop for HTTPS proxy"},
+  {"    --proxy-tls13-ciphers <ciphersuite list>",
+   "TLS 1.3 proxy cipher suites"},
   {"    --proxy-tlsauthtype <type>",
    "TLS authentication type for HTTPS proxy"},
   {"    --proxy-tlspassword <string>",
@@ -337,7 +341,7 @@ static const struct helptxt helptext[] = {
   {"    --proxy1.0 <host[:port]>",
    "Use HTTP/1.0 proxy on given port"},
   {"-p, --proxytunnel",
-   "Operate through a HTTP proxy tunnel (using CONNECT)"},
+   "Operate through an HTTP proxy tunnel (using CONNECT)"},
   {"    --pubkey <key>",
    "SSH Public key file name"},
   {"-Q, --quote",
@@ -362,7 +366,7 @@ static const struct helptxt helptext[] = {
    "Specify request command to use"},
   {"    --request-target",
    "Specify the target for this request"},
-  {"    --resolve <host:port:address>",
+  {"    --resolve <host:port:address[,address]...>",
    "Resolve the host+port to this address"},
   {"    --retry <num>",
    "Retry request if transient problems occur"},
@@ -414,6 +418,8 @@ static const struct helptxt helptext[] = {
    "Use SSLv3"},
   {"    --stderr",
    "Where to redirect stderr"},
+  {"    --styled-output",
+   "Enable styled output for HTTP headers"},
   {"    --suppress-connect-headers",
    "Suppress proxy CONNECT response headers"},
   {"    --tcp-fastopen",
@@ -430,6 +436,8 @@ static const struct helptxt helptext[] = {
    "Transfer based on a time condition"},
   {"    --tls-max <VERSION>",
    "Use TLSv1.0 or greater"},
+  {"    --tls13-ciphers <list of TLS 1.3 ciphersuites>",
+   "TLS 1.3 cipher suites to use"},
   {"    --tlsauthtype <type>",
    "TLS authentication type"},
   {"    --tlspassword",
diff --git a/src/tool_libinfo.c b/src/tool_libinfo.c
index d2bf7fb93..583570988 100644
--- a/src/tool_libinfo.c
+++ b/src/tool_libinfo.c
@@ -76,7 +76,6 @@ CURLcode get_libcurl_info(void)
     {  NULL,    0                }
   };
 
-  struct proto_name_pattern const *p;
   const char *const *proto;
 
   /* Pointer to libcurl's run-time version information */
@@ -88,6 +87,7 @@ CURLcode get_libcurl_info(void)
   built_in_protos = 0;
   if(curlinfo->protocols) {
     for(proto = curlinfo->protocols; *proto; proto++) {
+      struct proto_name_pattern const *p;
       for(p = possibly_built_in; p->proto_name; p++) {
         if(curl_strequal(*proto, p->proto_name)) {
           built_in_protos |= p->proto_pattern;
diff --git a/src/tool_main.c b/src/tool_main.c
index 4e78d3321..b9f7eae2c 100644
--- a/src/tool_main.c
+++ b/src/tool_main.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+ * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -147,6 +147,7 @@ static CURLcode main_init(struct GlobalConfig *config)
   /* Initialise the global config */
   config->showerror = -1;             /* Will show errors */
   config->errors = stderr;            /* Default errors to stderr */
+  config->styled_output = TRUE;       /* enable detection */
 
   /* Allocate the initial operate config */
   config->first = config->last = malloc(sizeof(struct OperationConfig));
diff --git a/src/tool_metalink.c b/src/tool_metalink.c
index 03f159745..f8effd374 100644
--- a/src/tool_metalink.c
+++ b/src/tool_metalink.c
@@ -246,7 +246,7 @@ static int nss_hash_init(void **pctx, SECOidTag hash_alg)
   /* we have to initialize NSS if not initialized already */
   if(!NSS_IsInitialized() && !nss_context) {
     static NSSInitParameters params;
-    params.length = sizeof params;
+    params.length = sizeof(params);
     nss_context = NSS_InitContext("", "", "", "", &params, NSS_INIT_READONLY
         | NSS_INIT_NOCERTDB   | NSS_INIT_NOMODDB       | NSS_INIT_FORCEOPEN
         | NSS_INIT_NOROOTINIT | NSS_INIT_OPTIMIZESPACE | NSS_INIT_PK11RELOAD);
@@ -529,7 +529,7 @@ digest_context *Curl_digest_init(const digest_params 
*dparams)
   digest_context *ctxt;
 
   /* Create digest context */
-  ctxt = malloc(sizeof *ctxt);
+  ctxt = malloc(sizeof(*ctxt));
 
   if(!ctxt)
     return ctxt;
diff --git a/src/tool_msgs.c b/src/tool_msgs.c
index 91d62ec1e..9cce8063e 100644
--- a/src/tool_msgs.c
+++ b/src/tool_msgs.c
@@ -109,8 +109,8 @@ void warnf(struct GlobalConfig *config, const char *fmt, 
...)
 
 void helpf(FILE *errors, const char *fmt, ...)
 {
-  va_list ap;
   if(fmt) {
+    va_list ap;
     va_start(ap, fmt);
     fputs("curl: ", errors); /* prefix it */
     vfprintf(errors, fmt, ap);
diff --git a/src/tool_operate.c b/src/tool_operate.c
index 626c30888..26fc251f5 100644
--- a/src/tool_operate.c
+++ b/src/tool_operate.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+ * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -851,15 +851,8 @@ static CURLcode operate_do(struct GlobalConfig *global,
           my_setopt(curl, CURLOPT_INFILESIZE_LARGE, uploadfilesize);
         my_setopt_str(curl, CURLOPT_URL, this_url);     /* what to fetch */
         my_setopt(curl, CURLOPT_NOPROGRESS, global->noprogress?1L:0L);
-        if(config->no_body) {
+        if(config->no_body)
           my_setopt(curl, CURLOPT_NOBODY, 1L);
-          my_setopt(curl, CURLOPT_HEADER, 1L);
-        }
-        /* If --metalink is used, we ignore --include (headers in
-           output) option because mixing headers to the body will
-           confuse XML parser and/or hash check will fail. */
-        else if(!config->use_metalink)
-          my_setopt(curl, CURLOPT_HEADER, config->include_headers?1L:0L);
 
         if(config->oauth_bearer)
           my_setopt_str(curl, CURLOPT_XOAUTH2_BEARER, config->oauth_bearer);
@@ -1223,6 +1216,13 @@ static CURLcode operate_do(struct GlobalConfig *global,
           my_setopt_str(curl, CURLOPT_PROXY_SSL_CIPHER_LIST,
                         config->proxy_cipher_list);
 
+        if(config->cipher13_list)
+          my_setopt_str(curl, CURLOPT_TLS13_CIPHERS, config->cipher13_list);
+
+        if(config->proxy_cipher13_list)
+          my_setopt_str(curl, CURLOPT_PROXY_SSL_CIPHER_LIST,
+                        config->proxy_cipher13_list);
+
         /* new in libcurl 7.9.2: */
         if(config->disable_epsv)
           /* disable it */
@@ -1373,6 +1373,8 @@ static CURLcode operate_do(struct GlobalConfig *global,
 
         hdrcbdata.outs = &outs;
         hdrcbdata.heads = &heads;
+        hdrcbdata.global = global;
+        hdrcbdata.config = config;
 
         my_setopt(curl, CURLOPT_HEADERFUNCTION, tool_header_cb);
         my_setopt(curl, CURLOPT_HEADERDATA, &hdrcbdata);
@@ -1472,6 +1474,9 @@ static CURLcode operate_do(struct GlobalConfig *global,
         if(config->haproxy_protocol)
           my_setopt(curl, CURLOPT_HAPROXYPROTOCOL, 1L);
 
+        if(config->disallow_username_in_url)
+          my_setopt(curl, CURLOPT_DISALLOW_USERNAME_IN_URL, 1L);
+
         /* initialize retry vars for loop below */
         retry_sleep_default = (config->retry_delay) ?
           config->retry_delay*1000L : RETRY_SLEEP_DEFAULT; /* ms */
@@ -1523,7 +1528,7 @@ static CURLcode operate_do(struct GlobalConfig *global,
             /* do not create (or even overwrite) the file in case we get no
                data because of unmet condition */
             curl_easy_getinfo(curl, CURLINFO_CONDITION_UNMET, &cond_unmet);
-            if(!cond_unmet && !tool_create_output_file(&outs))
+            if(!cond_unmet && !tool_create_output_file(&outs, FALSE))
               result = CURLE_WRITE_ERROR;
           }
 
diff --git a/src/tool_paramhlp.c b/src/tool_paramhlp.c
index 7cddf51ce..894d4d414 100644
--- a/src/tool_paramhlp.c
+++ b/src/tool_paramhlp.c
@@ -58,14 +58,14 @@ struct getout *new_getout(struct OperationConfig *config)
 
 ParameterError file2string(char **bufp, FILE *file)
 {
-  char buffer[256];
   char *ptr;
   char *string = NULL;
-  size_t stringlen = 0;
-  size_t buflen;
 
   if(file) {
+    char buffer[256];
+    size_t stringlen = 0;
     while(fgets(buffer, sizeof(buffer), file)) {
+      size_t buflen;
       ptr = strchr(buffer, '\r');
       if(ptr)
         *ptr = '\0';
@@ -91,11 +91,11 @@ ParameterError file2memory(char **bufp, size_t *size, FILE 
*file)
 {
   char *newbuf;
   char *buffer = NULL;
-  size_t alloc = 512;
   size_t nused = 0;
-  size_t nread;
 
   if(file) {
+    size_t nread;
+    size_t alloc = 512;
     do {
       if(!buffer || (alloc == nused)) {
         /* size_t overflow detection for huge files */
diff --git a/src/tool_parsecfg.c b/src/tool_parsecfg.c
index 540bdb18a..34b5d8b25 100644
--- a/src/tool_parsecfg.c
+++ b/src/tool_parsecfg.c
@@ -46,11 +46,9 @@ static char *my_get_line(FILE *fp);
 /* return 0 on everything-is-fine, and non-zero otherwise */
 int parseconfig(const char *filename, struct GlobalConfig *global)
 {
-  int res;
   FILE *file;
   char filebuffer[512];
   bool usedarg = FALSE;
-  char *home;
   int rc = 0;
   struct OperationConfig *operation = global->first;
 
@@ -58,8 +56,8 @@ int parseconfig(const char *filename, struct GlobalConfig 
*global)
     /* NULL or no file name attempts to load .curlrc from the homedir! */
 
 #ifndef __AMIGA__
+    char *home = homedir();    /* portable homedir finder */
     filename = CURLRC;   /* sensible default */
-    home = homedir();    /* portable homedir finder */
     if(home) {
       if(strlen(home) < (sizeof(filebuffer) - strlen(CURLRC))) {
         snprintf(filebuffer, sizeof(filebuffer),
@@ -125,13 +123,13 @@ int parseconfig(const char *filename, struct GlobalConfig 
*global)
     char *option;
     char *param;
     int lineno = 0;
-    bool alloced_param;
     bool dashed_option;
 
     while(NULL != (aline = my_get_line(file))) {
+      int res;
+      bool alloced_param = FALSE;
       lineno++;
       line = aline;
-      alloced_param = FALSE;
 
       /* line with # in the first non-blank column is a comment! */
       while(*line && ISSPACE(*line))
diff --git a/src/tool_urlglob.c b/src/tool_urlglob.c
index 6fae23620..fc8c2f529 100644
--- a/src/tool_urlglob.c
+++ b/src/tool_urlglob.c
@@ -622,12 +622,12 @@ CURLcode glob_match_url(char **result, char *filename, 
URLGlob *glob)
 
   while(*filename) {
     if(*filename == '#' && ISDIGIT(filename[1])) {
-      unsigned long i;
       char *ptr = filename;
       unsigned long num = strtoul(&filename[1], &filename, 10);
       URLPattern *pat = NULL;
 
       if(num < glob->size) {
+        unsigned long i;
         num--; /* make it zero based */
         /* find the correct glob entry */
         for(i = 0; i<glob->size; i++) {
diff --git a/src/tool_writeout.c b/src/tool_writeout.c
index 5d92bd278..ffe47c633 100644
--- a/src/tool_writeout.c
+++ b/src/tool_writeout.c
@@ -122,9 +122,9 @@ void ourWriteOut(CURL *curl, struct OutStruct *outs, const 
char *writeinfo)
       else {
         /* this is meant as a variable to output */
         char *end;
-        char keepit;
-        int i;
         if('{' == ptr[1]) {
+          char keepit;
+          int i;
           bool match = FALSE;
           end = strchr(ptr, '}');
           ptr += 2; /* pass the % and the { */
diff --git a/tests/Makefile.am b/tests/Makefile.am
index d6e6cfe29..77a9147ea 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -5,7 +5,7 @@
 #                            | (__| |_| |  _ <| |___
 #                             \___|\___/|_| \_\_____|
 #
-# Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+# Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
 #
 # This software is licensed as described in the file COPYING, which
 # you should have received as part of this distribution. The terms
@@ -75,7 +75,7 @@ TEST_T = -a -t
 TEST_E = -a -e
 
 # !flaky means that it'll skip all tests using the flaky keyword
-TEST_NF = -a -p -r !flaky
+TEST_NF = -a -p !flaky
 endif
 
 # make sure that PERL is pointing to an executable
diff --git a/tests/data/DISABLED b/tests/data/DISABLED
index fcbf0ffc4..11d54b463 100644
--- a/tests/data/DISABLED
+++ b/tests/data/DISABLED
@@ -18,5 +18,3 @@
 1510
 # Pipelining test that is causing false positives a little too often
 1903
-# causes memory leaks for now:
-1553
diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
index 51e80a8e9..0f204ecbb 100644
--- a/tests/data/Makefile.inc
+++ b/tests/data/Makefile.inc
@@ -127,7 +127,7 @@ test1120 test1121 test1122 test1123 test1124 test1125 
test1126 test1127 \
 test1128 test1129 test1130 test1131 test1132 test1133 test1134 test1135 \
 test1136 test1137 test1138                   test1141 test1142 test1143 \
 test1144 test1145 test1146 test1147 test1148 test1149 test1150 test1151 \
-test1152 test1153 test1154 test1155 \
+test1152 test1153 test1154 test1155 test1156 \
 \
 test1160 test1161 test1162 test1163 test1164 \
 test1170 test1171 \
@@ -175,9 +175,11 @@ test1520 test1521 \
 test1525 test1526 test1527 test1528 test1529 test1530 test1531 test1532 \
 test1533 test1534 test1535 test1536 test1537 test1538 \
 test1540 \
-test1550 test1551 test1552 test1553 test1554 test1555 test1556 \
+test1550 test1551 test1552 test1553 test1554 test1555 test1556 test1557 \
+\
+test1590 \
 test1600 test1601 test1602 test1603 test1604 test1605 test1606 test1607 \
-test1608 \
+test1608 test1609 \
 \
 test1700 test1701 test1702 \
 \
@@ -196,5 +198,6 @@ test2056 test2057 test2058 test2059 test2060 test2061 
test2062 test2063 \
 test2064 test2065 test2066 test2067 test2068 test2069 \
 \
 test2070 test2071 test2072 test2073 \
+test2074 test2075 \
 \
 test3000 test3001
diff --git a/tests/data/test1116 b/tests/data/test1116
index a9af3e61b..b72cbd60e 100644
--- a/tests/data/test1116
+++ b/tests/data/test1116
@@ -34,6 +34,8 @@ Transfer-Encoding: chunked
 Connection: mooo
 
 
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbcccccccccccccccccccccccccccccccc
+chunky-trailer: header data
+another-header: yes
 </datacheck>
 </reply>
 
diff --git a/tests/data/test1156 b/tests/data/test1156
new file mode 100644
index 000000000..fb4836242
--- /dev/null
+++ b/tests/data/test1156
@@ -0,0 +1,70 @@
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+Content-Range
+Resume
+Range
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 200 OK
+Content-Type: text/html
+Content-Length: 5
+
+body
+</data>
+
+<data1 nocheck="yes">
+HTTP/1.1 200 OK
+Content-Type: text/html
+Content-Length: 5
+Content-Range: bytes 3/7
+
+body
+</data1>
+
+<data2 nocheck="yes">
+HTTP/1.1 416 Requested Range Not Satisfiable
+Content-Type: text/html
+Content-Length: 5
+
+body
+</data2>
+
+<data3 nocheck="yes">
+HTTP/1.1 416 Requested Range Not Satisfiable
+Content-Type: text/html
+Content-Length: 5
+Content-Range: bytes */2
+
+body
+</data3>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<tool>
+lib1156
+</tool>
+ <name>
+HTTP resume/range fail range-error content-range combinations
+ </name>
+ <command>
+http://%HOSTIP:%HTTPPORT/want/1156
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<errorcode>
+0
+</errorcode>
+</testcase>
diff --git a/tests/data/test1319 b/tests/data/test1319
index 0520b1b32..f50c53165 100644
--- a/tests/data/test1319
+++ b/tests/data/test1319
@@ -31,9 +31,6 @@ body
 </data>
 
 <datacheck>
-HTTP/1.1 200 Mighty fine indeed
-pop3: sure hit me
-
 From: address@hidden
 To: address@hidden
 
diff --git a/tests/data/test1321 b/tests/data/test1321
index 266fd8828..ee1b47857 100644
--- a/tests/data/test1321
+++ b/tests/data/test1321
@@ -27,9 +27,6 @@ body
   yours sincerely
 </data>
 <datacheck>
-HTTP/1.1 200 Mighty fine indeed
-imap: sure hit me
-
 From: address@hidden
 To: address@hidden
 
diff --git a/tests/data/test1400 b/tests/data/test1400
index 194c99c85..92136157a 100644
--- a/tests/data/test1400
+++ b/tests/data/test1400
@@ -70,7 +70,6 @@ int main(int argc, char *argv[])
   hnd = curl_easy_init();
   curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 102400L);
   curl_easy_setopt(hnd, CURLOPT_URL, "http://%HOSTIP:%HTTPPORT/we/want/1400";);
-  curl_easy_setopt(hnd, CURLOPT_HEADER, 1L);
   curl_easy_setopt(hnd, CURLOPT_USERAGENT, "stripped");
   curl_easy_setopt(hnd, CURLOPT_MAXREDIRS, 50L);
   curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
diff --git a/tests/data/test1401 b/tests/data/test1401
index 940cf8eba..52e710722 100644
--- a/tests/data/test1401
+++ b/tests/data/test1401
@@ -82,7 +82,6 @@ int main(int argc, char *argv[])
   hnd = curl_easy_init();
   curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 102400L);
   curl_easy_setopt(hnd, CURLOPT_URL, "http://%HOSTIP:%HTTPPORT/we/want/1401";);
-  curl_easy_setopt(hnd, CURLOPT_HEADER, 1L);
   curl_easy_setopt(hnd, CURLOPT_USERPWD, "fake:user");
   curl_easy_setopt(hnd, CURLOPT_HTTPAUTH, (long)CURLAUTH_BASIC);
   curl_easy_setopt(hnd, CURLOPT_HTTPHEADER, slist1);
diff --git a/tests/data/test1402 b/tests/data/test1402
index 8fece3afe..3b4c69478 100644
--- a/tests/data/test1402
+++ b/tests/data/test1402
@@ -75,7 +75,6 @@ int main(int argc, char *argv[])
   hnd = curl_easy_init();
   curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 102400L);
   curl_easy_setopt(hnd, CURLOPT_URL, "http://%HOSTIP:%HTTPPORT/we/want/1402";);
-  curl_easy_setopt(hnd, CURLOPT_HEADER, 1L);
   curl_easy_setopt(hnd, CURLOPT_POSTFIELDS, "foo=bar&baz=quux");
   curl_easy_setopt(hnd, CURLOPT_POSTFIELDSIZE_LARGE, (curl_off_t)16);
   curl_easy_setopt(hnd, CURLOPT_USERAGENT, "stripped");
diff --git a/tests/data/test1403 b/tests/data/test1403
index 8e20fafdf..9466d42e5 100644
--- a/tests/data/test1403
+++ b/tests/data/test1403
@@ -72,7 +72,6 @@ int main(int argc, char *argv[])
   hnd = curl_easy_init();
   curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 102400L);
   curl_easy_setopt(hnd, CURLOPT_URL, 
"http://%HOSTIP:%HTTPPORT/we/want/1403?foo=bar&baz=quux";);
-  curl_easy_setopt(hnd, CURLOPT_HEADER, 1L);
   curl_easy_setopt(hnd, CURLOPT_USERAGENT, "stripped");
   curl_easy_setopt(hnd, CURLOPT_MAXREDIRS, 50L);
   curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
diff --git a/tests/data/test1404 b/tests/data/test1404
index a26f477bd..492751283 100644
--- a/tests/data/test1404
+++ b/tests/data/test1404
@@ -121,7 +121,6 @@ int main(int argc, char *argv[])
   hnd = curl_easy_init();
   curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 102400L);
   curl_easy_setopt(hnd, CURLOPT_URL, "http://%HOSTIP:%HTTPPORT/we/want/1404";);
-  curl_easy_setopt(hnd, CURLOPT_HEADER, 1L);
   mime1 = curl_mime_init(hnd);
   part1 = curl_mime_addpart(mime1);
   curl_mime_data(part1, "value", CURL_ZERO_TERMINATED);
diff --git a/tests/data/test1405 b/tests/data/test1405
index 50bfeb21a..543f48cf7 100644
--- a/tests/data/test1405
+++ b/tests/data/test1405
@@ -85,7 +85,6 @@ int main(int argc, char *argv[])
   hnd = curl_easy_init();
   curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 102400L);
   curl_easy_setopt(hnd, CURLOPT_URL, "ftp://%HOSTIP:%FTPPORT/1405";);
-  curl_easy_setopt(hnd, CURLOPT_HEADER, 1L);
   curl_easy_setopt(hnd, CURLOPT_QUOTE, slist1);
   curl_easy_setopt(hnd, CURLOPT_POSTQUOTE, slist2);
   curl_easy_setopt(hnd, CURLOPT_PREQUOTE, slist3);
diff --git a/tests/data/test1406 b/tests/data/test1406
index 680f6a25e..f6c235be9 100644
--- a/tests/data/test1406
+++ b/tests/data/test1406
@@ -78,7 +78,6 @@ int main(int argc, char *argv[])
   curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 102400L);
   curl_easy_setopt(hnd, CURLOPT_INFILESIZE_LARGE, (curl_off_t)38);
   curl_easy_setopt(hnd, CURLOPT_URL, "smtp://%HOSTIP:%SMTPPORT/1406");
-  curl_easy_setopt(hnd, CURLOPT_HEADER, 1L);
   curl_easy_setopt(hnd, CURLOPT_UPLOAD, 1L);
   curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
   curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
diff --git a/tests/data/test1407 b/tests/data/test1407
index bb4c4f128..3c624df9f 100644
--- a/tests/data/test1407
+++ b/tests/data/test1407
@@ -59,7 +59,6 @@ int main(int argc, char *argv[])
   hnd = curl_easy_init();
   curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 102400L);
   curl_easy_setopt(hnd, CURLOPT_URL, "pop3://%HOSTIP:%POP3PORT/1407");
-  curl_easy_setopt(hnd, CURLOPT_HEADER, 1L);
   curl_easy_setopt(hnd, CURLOPT_DIRLISTONLY, 1L);
   curl_easy_setopt(hnd, CURLOPT_USERPWD, "user:secret");
   curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
diff --git a/tests/data/test1417 b/tests/data/test1417
index 13ba6b168..4d3971ea8 100644
--- a/tests/data/test1417
+++ b/tests/data/test1417
@@ -35,6 +35,7 @@ Trailer: chunky-trailer
 Connection: mooo
 
 
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbcccccccccccccccccccccccccccccccc
+chunky-trailer: header data
 </datacheck>
 </reply>
 
diff --git a/tests/data/test1420 b/tests/data/test1420
index 1c98d2c28..7aca2525e 100644
--- a/tests/data/test1420
+++ b/tests/data/test1420
@@ -65,7 +65,6 @@ int main(int argc, char *argv[])
   hnd = curl_easy_init();
   curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 102400L);
   curl_easy_setopt(hnd, CURLOPT_URL, "imap://%HOSTIP:%IMAPPORT/1420/;UID=1");
-  curl_easy_setopt(hnd, CURLOPT_HEADER, 1L);
   curl_easy_setopt(hnd, CURLOPT_USERPWD, "user:secret");
   curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
   curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
diff --git a/tests/data/test1455 b/tests/data/test1455
index 7768a1f89..0b77dc4f5 100644
--- a/tests/data/test1455
+++ b/tests/data/test1455
@@ -35,7 +35,7 @@ http
 HTTP GET when PROXY Protocol enabled
 </name>
 <command>
-http://%HOSTIP:%HTTPPORT/1455 --haproxy-protocol --local-port 37756
+http://%HOSTIP:%HTTPPORT/1455 --haproxy-protocol
 </command>
 </client>
 
@@ -45,8 +45,11 @@ http://%HOSTIP:%HTTPPORT/1455 --haproxy-protocol 
--local-port 37756
 <strip>
 ^User-Agent:.*
 </strip>
+<strippart>
+s/^PROXY TCP4 %CLIENTIP %HOSTIP (\d*) %HTTPPORT/proxy-line/
+</strippart>
 <protocol>
-PROXY TCP4 %CLIENTIP %HOSTIP 37756 %HTTPPORT
+proxy-line
 GET /1455 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
diff --git a/tests/data/test1553 b/tests/data/test1553
index c2fb9cc32..5e793b391 100644
--- a/tests/data/test1553
+++ b/tests/data/test1553
@@ -38,7 +38,9 @@ IMAP cleanup before a connection was created
 <tool>
 lib1553
 </tool>
- <command>
+
+# this MUST use a host name that doesn't resolve
+<command>
 imap://non-existing-host.haxx.se:%IMAPPORT/1553
 </command>
 </client>
diff --git a/tests/data/test507 b/tests/data/test1557
similarity index 52%
copy from tests/data/test507
copy to tests/data/test1557
index 9549bd986..16e2a2c47 100644
--- a/tests/data/test507
+++ b/tests/data/test1557
@@ -1,37 +1,36 @@
 <testcase>
 <info>
 <keywords>
-HTTP
 multi
-FAILURE
-non-existing host
+crash
 </keywords>
 </info>
 
-# Server-side
 <reply>
 </reply>
 
-# Client-side
 <client>
 <server>
-http
+none
 </server>
-<name>
-multi interface get with non-existing host name
-</name>
 <tool>
-lib507
+lib1557
 </tool>
+
+<name>
+Removing easy handle that's in the pending connections list doesn't leave 
behind a dangling entry
+</name>
 <command>
-http://non-existing-host.haxx.se/
+nothing
 </command>
 </client>
 
-# Verify data after the test has been "shot"
+#
+# Verify that the test runs to completion without crashing
 <verify>
 <errorcode>
-6
+0
 </errorcode>
 </verify>
+
 </testcase>
diff --git a/tests/data/test1553 b/tests/data/test1590
similarity index 81%
copy from tests/data/test1553
copy to tests/data/test1590
index c2fb9cc32..b605022af 100644
--- a/tests/data/test1553
+++ b/tests/data/test1590
@@ -38,8 +38,10 @@ IMAP cleanup before a connection was created
 <tool>
 lib1553
 </tool>
- <command>
-imap://non-existing-host.haxx.se:%IMAPPORT/1553
+
+# it is important this uses a host name that resolves successfully
+<command>
+imap://localhost:%IMAPPORT/1590
 </command>
 </client>
 
diff --git a/tests/data/test1607 b/tests/data/test1609
similarity index 96%
copy from tests/data/test1607
copy to tests/data/test1609
index 9628324e4..c1b7c7a11 100644
--- a/tests/data/test1607
+++ b/tests/data/test1609
@@ -19,7 +19,7 @@ unittest
 CURLOPT_RESOLVE parsing
  </name>
 <tool>
-unit1607
+unit1609
 </tool>
 </client>
 
diff --git a/tests/data/test2010 b/tests/data/test2010
index b8b3ddcc2..91a83f4dc 100644
--- a/tests/data/test2010
+++ b/tests/data/test2010
@@ -35,10 +35,10 @@ Metalink
 http
 </server>
  <name>
-Metalink local XML file, HTTP resource, using -o fname -i -D file
+Metalink local XML file, HTTP resource, using -o fname -D file
  </name>
 <command option="no-output,no-include">
---metalink file://%PWD/log/test2010.metalink -i -o log/outfile2010 -D 
log/heads2010
+--metalink file://%PWD/log/test2010.metalink -o log/outfile2010 -D 
log/heads2010
 </command>
 # local metalink file written before test command runs
 <file name="log/test2010.metalink">
diff --git a/tests/data/test1 b/tests/data/test2074
similarity index 82%
copy from tests/data/test1
copy to tests/data/test2074
index 7c0e1602a..ecff8fe7e 100644
--- a/tests/data/test1
+++ b/tests/data/test2074
@@ -3,6 +3,7 @@
 <keywords>
 HTTP
 HTTP GET
+AUTH OAUTHBEARER
 </keywords>
 </info>
 
@@ -35,7 +36,7 @@ http
 HTTP GET
  </name>
  <command>
-http://%HOSTIP:%HTTPPORT/1
+http://%HOSTIP:%HTTPPORT/2074 --oauth2-bearer mF_9.B5f-4.1JqM
 </command>
 </client>
 
@@ -46,8 +47,9 @@ http://%HOSTIP:%HTTPPORT/1
 ^User-Agent:.*
 </strip>
 <protocol>
-GET /1 HTTP/1.1
+GET /2074 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
+Authorization: Bearer mF_9.B5f-4.1JqM
 Accept: */*
 
 </protocol>
diff --git a/tests/data/test2044 b/tests/data/test2075
similarity index 60%
copy from tests/data/test2044
copy to tests/data/test2075
index 33e81a8d9..88db7ae29 100644
--- a/tests/data/test2044
+++ b/tests/data/test2075
@@ -1,7 +1,8 @@
 <testcase>
 <info>
 <keywords>
---proto-default
+--disallow-username-in-url
+HTTP
 </keywords>
 </info>
 
@@ -9,25 +10,25 @@
 # Client-side
 <client>
 <features>
-none
+http
 </features>
 <server>
 none
 </server>
 <name>
-Attempt to set a default protocol that does not exist
+Verify usernames are not allowed in url
 </name>
 <command>
---proto-default DOESNOTEXIST
+--disallow-username-in-url http://username:address@hidden/
 </command>
 </client>
 
 #
 # Verify data after the test has been "shot"
 <verify>
-# CURLE_UNSUPPORTED_PROTOCOL is error code 1
+# CURLE_LOGIN_DENIED is code 67
 <errorcode>
-1
+67
 </errorcode>
 </verify>
 </testcase>
diff --git a/tests/data/test266 b/tests/data/test266
index d520be0f4..6b07a782b 100644
--- a/tests/data/test266
+++ b/tests/data/test266
@@ -35,6 +35,7 @@ Trailer: chunky-trailer
 Connection: mooo
 
 
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbcccccccccccccccccccccccccccccccc
+chunky-trailer: header data
 </datacheck>
 </reply>
 
diff --git a/tests/data/test46 b/tests/data/test46
index fd0e666c6..64a7b86e4 100644
--- a/tests/data/test46
+++ b/tests/data/test46
@@ -51,8 +51,8 @@ domain..tld:%HTTPPORT/want/46 --resolve 
domain..tld:%HTTPPORT:%HOSTIP -c log/jar
 
 www.fake.come  FALSE   /       FALSE   2022144953      cookiecliente   si
 www.loser.com  FALSE   /       FALSE   2139150993      UID     99
-domain..tld    FALSE   /       FALSE   1739150993      mooo    indeed
-#HttpOnly_domain..tld  FALSE   /want   FALSE   1739150993      mooo2   indeed2
+domain..tld    FALSE   /       FALSE   2139150993      mooo    indeed
+#HttpOnly_domain..tld  FALSE   /want   FALSE   2139150993      mooo2   indeed2
 domain..tld    FALSE   /want   FALSE   0       empty   
 </file>
 </client>
@@ -75,8 +75,8 @@ Cookie: empty=; mooo2=indeed2; mooo=indeed
 # This file was generated by libcurl! Edit at your own risk.
 
 www.fake.come  FALSE   /       FALSE   2022144953      cookiecliente   si
-domain..tld    FALSE   /       FALSE   1739150993      mooo    indeed
-#HttpOnly_domain..tld  FALSE   /want   FALSE   1739150993      mooo2   indeed2
+domain..tld    FALSE   /       FALSE   2139150993      mooo    indeed
+#HttpOnly_domain..tld  FALSE   /want   FALSE   2139150993      mooo2   indeed2
 domain..tld    FALSE   /want   FALSE   0       empty   
 domain..tld    FALSE   /       FALSE   2054030187      ckyPersistent   
permanent
 domain..tld    FALSE   /       FALSE   0       ckySession      temporary
diff --git a/tests/data/test851 b/tests/data/test851
index 60c49c47f..6269dd776 100644
--- a/tests/data/test851
+++ b/tests/data/test851
@@ -11,7 +11,7 @@ LIST
 # Server-side
 <reply>
 <servercmd>
-# include the '.\r\n' 3-byte trailer to end the transfer poperly!
+# include the '.\r\n' 3-byte trailer to end the transfer properly!
 REPLY LIST +OK 851 100\r\n.
 </servercmd>
 </reply>
diff --git a/tests/data/test92 b/tests/data/test92
index 1304c81ec..728d271b0 100644
--- a/tests/data/test92
+++ b/tests/data/test92
@@ -23,6 +23,20 @@ Content-Type: image/gif
 
 bad
 </data>
+
+# The body should be ignored.
+<datacheck>
+HTTP/1.1 416 Requested Range Not Satisfiable
+Date: Fri, 24 Oct 2003 21:33:12 GMT
+Server: Apache/1.3.19 (Unix) (Red-Hat/Linux) mod_ssl/2.8.1 OpenSSL/0.9.6 
PHP/4.3.1
+Last-Modified: Fri, 24 Oct 2003 18:01:23 GMT
+ETag: "ab57a-507-3f9968f3"
+Accept-Ranges: bytes
+Content-Length: 4
+Content-Range: bytes */87
+Content-Type: image/gif
+
+</datacheck>
 </reply>
 
 # Client-side
diff --git a/tests/libtest/.gitignore b/tests/libtest/.gitignore
index e10d96d9a..611404721 100644
--- a/tests/libtest/.gitignore
+++ b/tests/libtest/.gitignore
@@ -1,10 +1,6 @@
 chkhostname
-lib15[0-9][0-9]
+lib[12][0-9][0-9][0-9]
+lib[56][0-9][0-9]
 lib1521.c
-lib19[0-9][0-9]
-lib2033
-lib5[0-9][0-9]
-lib64[3-5]
-lib65[0-9]
 libauthretry
 libntlmconnect
diff --git a/tests/libtest/CMakeLists.txt b/tests/libtest/CMakeLists.txt
index db0aed694..afcd372d3 100644
--- a/tests/libtest/CMakeLists.txt
+++ b/tests/libtest/CMakeLists.txt
@@ -20,12 +20,6 @@ function(SETUP_TEST TEST_NAME)          # ARGN are the files 
in the test
     PROPERTIES COMPILE_DEFINITIONS ${UPPER_TEST_NAME})
   set_target_properties(${TEST_NAME}
     PROPERTIES PROJECT_LABEL "${TARGET_LABEL_PREFIX}${TEST_NAME}")
-
-  # Add the postfix to the executable since it is
-  # not added automatically as for modules and shared libraries
-  set_target_properties(${TEST_NAME}
-    PROPERTIES DEBUG_POSTFIX "${CMAKE_DEBUG_POSTFIX}")
-
 endfunction()
 
 
@@ -33,7 +27,11 @@ transform_makefile_inc("Makefile.inc" 
"${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.
 include(${CMAKE_CURRENT_BINARY_DIR}/Makefile.inc.cmake)
 
 foreach(TEST_NAME ${noinst_PROGRAMS})
-  setup_test(${TEST_NAME} ${${TEST_NAME}_SOURCES})
+  if(DEFINED ${TEST_NAME}_SOURCES)
+    setup_test(${TEST_NAME} ${${TEST_NAME}_SOURCES})
+  else()
+    setup_test(${TEST_NAME} ${nodist_${TEST_NAME}_SOURCES})
+  endif()
 endforeach()
 
 # Allows for hostname override to make tests machine independent.
diff --git a/tests/libtest/Makefile.am b/tests/libtest/Makefile.am
index 15fa2990c..07694d205 100644
--- a/tests/libtest/Makefile.am
+++ b/tests/libtest/Makefile.am
@@ -51,6 +51,8 @@ CFLAG_CURL_SYMBOL_HIDING = @CFLAG_CURL_SYMBOL_HIDING@
 
 CFLAGS += @CURL_CFLAG_EXTRAS@
 
+CLEANFILES = lib1521.c
+
 # Prevent LIBS from being used for all link targets
 LIBS = $(BLANK_AT_MAKETIME)
 
@@ -117,7 +119,7 @@ noinst_LTLIBRARIES += libstubgss.la
 
 libstubgss_la_CPPFLAGS = $(AM_CPPFLAGS)
 libstubgss_la_LDFLAGS = $(AM_LDFLAGS) -avoid-version -rpath /nowhere
-libstubgss_la_CFLAGS = $(AM_CFLAGS) -g -Wno-unused-parameter
+libstubgss_la_CFLAGS = $(AM_CFLAGS) -g
 
 libstubgss_la_SOURCES = stub_gssapi.c stub_gssapi.h
 
@@ -131,6 +133,3 @@ lib1521.c: $(top_srcdir)/tests/libtest/mk-lib1521.pl 
$(top_srcdir)/include/gnurl
 
 checksrc:
        @PERL@ $(top_srcdir)/lib/checksrc.pl $(srcdir)/*.c
-
-dist:
-       rm lib1521.c
diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc
index e7e8c486a..ecb7d1dd4 100644
--- a/tests/libtest/Makefile.inc
+++ b/tests/libtest/Makefile.inc
@@ -21,13 +21,14 @@ noinst_PROGRAMS = chkhostname libauthretry libntlmconnect   
             \
  lib571 lib572 lib573 lib574 lib575 lib576        lib578 lib579 lib582   \
  lib583 lib585 lib586 lib587 lib589 lib590 lib591 lib597 lib598 lib599   \
  lib643 lib644 lib645 lib650 lib651 lib652 lib653 lib654 lib655 \
+ lib1156 \
  lib1500 lib1501 lib1502 lib1503 lib1504 lib1505 lib1506 lib1507 lib1508 \
  lib1509 lib1510 lib1511 lib1512 lib1513 lib1514 lib1515         lib1517 \
  lib1520 lib1521 \
  lib1525 lib1526 lib1527 lib1528 lib1529 lib1530 lib1531 lib1532 lib1533 \
  lib1534 lib1535 lib1536 lib1537 lib1538 \
  lib1540 \
- lib1550 lib1551 lib1552 lib1553 lib1554 lib1555 lib1556 \
+ lib1550 lib1551 lib1552 lib1553 lib1554 lib1555 lib1556 lib1557 \
  lib1900 \
  lib2033
 
@@ -358,6 +359,10 @@ lib1506_SOURCES = lib1506.c $(SUPPORTFILES) $(TESTUTIL) 
$(WARNLESS)
 lib1506_LDADD = $(TESTUTIL_LIBS)
 lib1506_CPPFLAGS = $(AM_CPPFLAGS) -DLIB1506
 
+lib1156_SOURCES = lib1156.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
+lib1156_LDADD = $(TESTUTIL_LIBS)
+lib1156_CPPFLAGS = $(AM_CPPFLAGS) -DLIB1156
+
 lib1507_SOURCES = lib1507.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
 lib1507_LDADD = $(TESTUTIL_LIBS)
 lib1507_CPPFLAGS = $(AM_CPPFLAGS) -DLIB1507
@@ -400,7 +405,7 @@ lib1517_CPPFLAGS = $(AM_CPPFLAGS) -DLIB1517
 lib1520_SOURCES = lib1520.c $(SUPPORTFILES)
 lib1520_CPPFLAGS = $(AM_CPPFLAGS) -DLIB1520
 
-lib1521_SOURCES = lib1521.c $(SUPPORTFILES)
+nodist_lib1521_SOURCES = lib1521.c $(SUPPORTFILES)
 lib1521_CPPFLAGS = $(AM_CPPFLAGS) -I$(srcdir)
 
 lib1525_SOURCES = lib1525.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
@@ -488,6 +493,10 @@ lib1556_SOURCES = lib1556.c $(SUPPORTFILES) $(TESTUTIL) 
$(WARNLESS)
 lib1556_LDADD = $(TESTUTIL_LIBS)
 lib1556_CPPFLAGS = $(AM_CPPFLAGS) -DLIB1556
 
+lib1557_SOURCES = lib1557.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
+lib1557_LDADD = $(TESTUTIL_LIBS)
+lib1557_CPPFLAGS = $(AM_CPPFLAGS) -DLIB1557
+
 lib1900_SOURCES = lib1900.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
 lib1900_LDADD = $(TESTUTIL_LIBS)
 lib1900_CPPFLAGS = $(AM_CPPFLAGS)
diff --git a/tests/libtest/lib1156.c b/tests/libtest/lib1156.c
new file mode 100644
index 000000000..63348de76
--- /dev/null
+++ b/tests/libtest/lib1156.c
@@ -0,0 +1,162 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.haxx.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ ***************************************************************************/
+#include "test.h"
+
+/*
+  Check range/resume returned error codes and data presence.
+
+  The input parameters are:
+  - CURLOPT_RANGE/CURLOPT_RESUME_FROM
+  - CURLOPT_FAILONERROR
+  - Returned http code (2xx/416)
+  - Content-Range header present in reply.
+
+*/
+
+#include "memdebug.h"
+
+#define F_RESUME        (1 << 0)        /* resume/range. */
+#define F_HTTP416       (1 << 1)        /* Server returns http code 416. */
+#define F_FAIL          (1 << 2)        /* Fail on error. */
+#define F_CONTENTRANGE  (1 << 3)        /* Server sends content-range hdr. */
+#define F_IGNOREBODY    (1 << 4)        /* Body should be ignored. */
+
+typedef struct {
+  unsigned int flags; /* ORed flags as above. */
+  CURLcode result; /* Code that should be returned by curl_easy_perform(). */
+}  testparams;
+
+static const testparams params[] = {
+  { 0,                                                             CURLE_OK },
+  {                                 F_CONTENTRANGE,                CURLE_OK },
+  {                        F_FAIL,                                 CURLE_OK },
+  {                        F_FAIL | F_CONTENTRANGE,                CURLE_OK },
+  {            F_HTTP416,                                          CURLE_OK },
+  {            F_HTTP416 |          F_CONTENTRANGE,                CURLE_OK },
+  {            F_HTTP416 | F_FAIL |                  F_IGNOREBODY,
+                                                  CURLE_HTTP_RETURNED_ERROR },
+  {            F_HTTP416 | F_FAIL | F_CONTENTRANGE | F_IGNOREBODY,
+                                                  CURLE_HTTP_RETURNED_ERROR },
+  { F_RESUME |                                       F_IGNOREBODY,
+                                                          CURLE_RANGE_ERROR },
+  { F_RESUME |                      F_CONTENTRANGE,                CURLE_OK },
+  { F_RESUME |             F_FAIL |                  F_IGNOREBODY,
+                                                          CURLE_RANGE_ERROR },
+  { F_RESUME |             F_FAIL | F_CONTENTRANGE,                CURLE_OK },
+  { F_RESUME | F_HTTP416 |                           F_IGNOREBODY, CURLE_OK },
+  { F_RESUME | F_HTTP416 |          F_CONTENTRANGE | F_IGNOREBODY, CURLE_OK },
+  { F_RESUME | F_HTTP416 | F_FAIL |                  F_IGNOREBODY,
+                                                  CURLE_HTTP_RETURNED_ERROR },
+  { F_RESUME | F_HTTP416 | F_FAIL | F_CONTENTRANGE | F_IGNOREBODY,
+                                                  CURLE_HTTP_RETURNED_ERROR }
+};
+
+static int      hasbody;
+
+static size_t writedata(char *data, size_t size, size_t nmemb, void *userdata)
+{
+  (void) data;
+  (void) userdata;
+
+  if(size && nmemb)
+    hasbody = 1;
+  return size * nmemb;
+}
+
+static int onetest(CURL *curl, const char *url, const testparams *p)
+{
+  CURLcode res;
+  unsigned int replyselector;
+  char urlbuf[256];
+
+  replyselector = p->flags & F_CONTENTRANGE? 1: 0;
+  if(p->flags & F_HTTP416)
+    replyselector += 2;
+  snprintf(urlbuf, sizeof(urlbuf), "%s%04u", url, replyselector);
+  test_setopt(curl, CURLOPT_URL, urlbuf);
+  test_setopt(curl, CURLOPT_RESUME_FROM, (p->flags & F_RESUME)? 3: 0);
+  test_setopt(curl, CURLOPT_RANGE, !(p->flags & F_RESUME)?
+                                   "3-1000000": (char *) NULL);
+  test_setopt(curl, CURLOPT_FAILONERROR, p->flags & F_FAIL? 1: 0);
+  hasbody = 0;
+  res = curl_easy_perform(curl);
+  if(res != p->result) {
+    fprintf(stderr, "bad error code (%d): resume=%s, fail=%s, http416=%s, "
+                    "content-range=%s, expected=%d\n", res,
+                    (p->flags & F_RESUME)? "yes": "no",
+                    (p->flags & F_FAIL)? "yes": "no",
+                    (p->flags & F_HTTP416)? "yes": "no",
+                    (p->flags & F_CONTENTRANGE)? "yes": "no",
+                    p->result);
+    return 1;
+  }
+  if(hasbody && (p->flags & F_IGNOREBODY)) {
+    fprintf(stderr, "body should be ignored and is not: resume=%s, fail=%s, "
+                    "http416=%s, content-range=%s\n",
+                    (p->flags & F_RESUME)? "yes": "no",
+                    (p->flags & F_FAIL)? "yes": "no",
+                    (p->flags & F_HTTP416)? "yes": "no",
+                    (p->flags & F_CONTENTRANGE)? "yes": "no");
+    return 1;
+  }
+  return 0;
+
+  test_cleanup:
+
+  return 1;
+}
+
+int test(char *URL)
+{
+  CURLcode res;
+  CURL *curl;
+  size_t i;
+  int status = 0;
+
+  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+    fprintf(stderr, "curl_global_init() failed\n");
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  curl = curl_easy_init();
+  if(!curl) {
+    fprintf(stderr, "curl_easy_init() failed\n");
+    curl_global_cleanup();
+    return TEST_ERR_MAJOR_BAD;
+  }
+
+  test_setopt(curl, CURLOPT_WRITEFUNCTION, writedata);
+
+  for(i = 0; i < sizeof(params) / sizeof(params[0]); i++)
+    status |= onetest(curl, URL, params + i);
+
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
+  return status;
+
+  test_cleanup:
+
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
+
+  return (int)res;
+}
diff --git a/tests/libtest/lib1537.c b/tests/libtest/lib1537.c
index b07d64fc5..9832c3a30 100644
--- a/tests/libtest/lib1537.c
+++ b/tests/libtest/lib1537.c
@@ -43,8 +43,7 @@ int test(char *URL)
   asize = (int)sizeof(a);
   ptr = curl_easy_escape(NULL, (char *)a, asize);
   printf("%s\n", ptr);
-  if(ptr)
-    curl_free(ptr);
+  curl_free(ptr);
 
   /* deprecated API */
   ptr = curl_escape((char *)a, asize);
@@ -58,8 +57,7 @@ int test(char *URL)
   printf("outlen == %d\n", outlen);
   printf("unescape == original? %s\n",
          memcmp(raw, a, outlen) ? "no" : "YES");
-  if(raw)
-    curl_free(raw);
+  curl_free(raw);
 
   /* deprecated API */
   raw = curl_unescape(ptr, (int)strlen(ptr));
@@ -71,10 +69,8 @@ int test(char *URL)
   printf("[old] outlen == %d\n", outlen);
   printf("[old] unescape == original? %s\n",
          memcmp(raw, a, outlen) ? "no" : "YES");
-  if(raw)
-    curl_free(raw);
-  if(ptr)
-    curl_free(ptr);
+  curl_free(raw);
+  curl_free(ptr);
 
   /* weird input length */
   ptr = curl_easy_escape(NULL, (char *)a, -1);
@@ -86,8 +82,7 @@ int test(char *URL)
   printf("unescape -1 length: %s %d\n", ptr, outlen);
 
 test_cleanup:
-  if(ptr)
-    curl_free(ptr);
+  curl_free(ptr);
   curl_global_cleanup();
 
   return (int)res;
diff --git a/tests/libtest/lib1554.c b/tests/libtest/lib1554.c
index 8842ae2f7..df12fe52e 100644
--- a/tests/libtest/lib1554.c
+++ b/tests/libtest/lib1554.c
@@ -43,7 +43,6 @@ static void my_unlock(CURL *handle, curl_lock_data data, void 
*useptr)
 /* test function */
 int test(char *URL)
 {
-  CURL *curl;
   CURLcode res = CURLE_OK;
   CURLSH *share;
   int i;
@@ -65,7 +64,7 @@ int test(char *URL)
      still reuse connections since the pool is in the shared object! */
 
   for(i = 0; i < 3; i++) {
-    curl = curl_easy_init();
+    CURL *curl = curl_easy_init();
     if(curl) {
       curl_easy_setopt(curl, CURLOPT_URL, URL);
 
diff --git a/tests/libtest/lib1508.c b/tests/libtest/lib1557.c
similarity index 62%
copy from tests/libtest/lib1508.c
copy to tests/libtest/lib1557.c
index f536422cb..bd0f20a85 100644
--- a/tests/libtest/lib1508.c
+++ b/tests/libtest/lib1557.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 2013, Linus Nielsen Feltzing <address@hidden>
+ * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -27,23 +27,36 @@
 
 int test(char *URL)
 {
+  CURLM *curlm = NULL;
+  CURL *curl1 = NULL;
+  CURL *curl2 = NULL;
+  int running_handles = 0;
   int res = 0;
-  CURLM *m = NULL;
-
-  (void)URL;
 
   global_init(CURL_GLOBAL_ALL);
 
-  multi_init(m);
+  multi_init(curlm);
+  multi_setopt(curlm, CURLMOPT_MAX_HOST_CONNECTIONS, 1);
 
-test_cleanup:
+  easy_init(curl1);
+  easy_setopt(curl1, CURLOPT_URL, URL);
+  multi_add_handle(curlm, curl1);
 
-  /* proper cleanup sequence - type PB */
+  easy_init(curl2);
+  easy_setopt(curl2, CURLOPT_URL, URL);
+  multi_add_handle(curlm, curl2);
 
-  curl_multi_cleanup(m);
-  curl_global_cleanup();
+  multi_perform(curlm, &running_handles);
 
-  printf("We are done\n");
+  multi_remove_handle(curlm, curl2);
+  curl_easy_cleanup(curl2);
 
+  /* If curl2 is still in the connect-pending list, this will crash */
+  multi_remove_handle(curlm, curl1);
+  curl_easy_cleanup(curl1);
+
+test_cleanup:
+  curl_multi_cleanup(curlm);
+  curl_global_cleanup();
   return res;
 }
diff --git a/tests/libtest/lib1900.c b/tests/libtest/lib1900.c
index 109c57062..cf55fb332 100644
--- a/tests/libtest/lib1900.c
+++ b/tests/libtest/lib1900.c
@@ -63,14 +63,14 @@ static int parse_url_file(const char *filename)
     return 0;
 
   while(!feof(f)) {
-    if(fscanf(f, "%d %s\n", &filetime, buf)) {
+    if(fscanf(f, "%d %199s\n", &filetime, buf)) {
       urltime[num_handles] = filetime;
       urlstring[num_handles] = strdup(buf);
       num_handles++;
       continue;
     }
 
-    if(fscanf(f, "blacklist_site %s\n", buf)) {
+    if(fscanf(f, "blacklist_site %199s\n", buf)) {
       site_blacklist[blacklist_num_sites] = strdup(buf);
       blacklist_num_sites++;
       continue;
@@ -192,11 +192,11 @@ int test(char *URL)
     do {
       msg = curl_multi_info_read(m, &msgs_left);
       if(msg && msg->msg == CURLMSG_DONE) {
-        int i, found = 0;
+        int i;
 
         /* Find out which handle this message is about */
         for(i = 0; i < num_handles; i++) {
-          found = (msg->easy_handle == handles[i]);
+          int found = (msg->easy_handle == handles[i]);
           if(found)
             break;
         }
diff --git a/tests/libtest/lib500.c b/tests/libtest/lib500.c
index 677ab73a7..2a6c58bb5 100644
--- a/tests/libtest/lib500.c
+++ b/tests/libtest/lib500.c
@@ -96,36 +96,50 @@ int test(char *URL)
     if(libtest_arg2) {
       FILE *moo = fopen(libtest_arg2, "wb");
       if(moo) {
-        double time_namelookup;
-        double time_connect;
-        double time_pretransfer;
-        double time_starttransfer;
-        double time_total;
+        curl_off_t time_namelookup;
+        curl_off_t time_connect;
+        curl_off_t time_pretransfer;
+        curl_off_t time_starttransfer;
+        curl_off_t time_total;
         fprintf(moo, "IP: %s\n", ipstr);
-        curl_easy_getinfo(curl, CURLINFO_NAMELOOKUP_TIME, &time_namelookup);
-        curl_easy_getinfo(curl, CURLINFO_CONNECT_TIME, &time_connect);
-        curl_easy_getinfo(curl, CURLINFO_PRETRANSFER_TIME, &time_pretransfer);
-        curl_easy_getinfo(curl, CURLINFO_STARTTRANSFER_TIME,
+        curl_easy_getinfo(curl, CURLINFO_NAMELOOKUP_TIME_T, &time_namelookup);
+        curl_easy_getinfo(curl, CURLINFO_CONNECT_TIME_T, &time_connect);
+        curl_easy_getinfo(curl, CURLINFO_PRETRANSFER_TIME_T,
+                          &time_pretransfer);
+        curl_easy_getinfo(curl, CURLINFO_STARTTRANSFER_TIME_T,
                           &time_starttransfer);
-        curl_easy_getinfo(curl, CURLINFO_TOTAL_TIME, &time_total);
+        curl_easy_getinfo(curl, CURLINFO_TOTAL_TIME_T, &time_total);
 
         /* since the timing will always vary we only compare relative
            differences between these 5 times */
         if(time_namelookup > time_connect) {
-          fprintf(moo, "namelookup vs connect: %f %f\n",
-                  time_namelookup, time_connect);
+          fprintf(moo, "namelookup vs connect: %" CURL_FORMAT_CURL_OFF_T
+                  ".%06ld %" CURL_FORMAT_CURL_OFF_T ".%06ld\n",
+                  (time_namelookup / 1000000),
+                  (long)(time_namelookup % 1000000),
+                  (time_connect / 1000000), (long)(time_connect % 1000000));
         }
         if(time_connect > time_pretransfer) {
-          fprintf(moo, "connect vs pretransfer: %f %f\n",
-                  time_connect, time_pretransfer);
+          fprintf(moo, "connect vs pretransfer: %" CURL_FORMAT_CURL_OFF_T
+                  ".%06ld %" CURL_FORMAT_CURL_OFF_T ".%06ld\n",
+                  (time_connect / 1000000), (long)(time_connect % 1000000),
+                  (time_pretransfer / 1000000),
+                  (long)(time_pretransfer % 1000000));
         }
         if(time_pretransfer > time_starttransfer) {
-          fprintf(moo, "pretransfer vs starttransfer: %f %f\n",
-                  time_pretransfer, time_starttransfer);
+          fprintf(moo, "pretransfer vs starttransfer: %" CURL_FORMAT_CURL_OFF_T
+                  ".%06ld %" CURL_FORMAT_CURL_OFF_T ".%06ld\n",
+                  (time_pretransfer / 1000000),
+                  (long)(time_pretransfer % 1000000),
+                  (time_starttransfer / 1000000),
+                  (long)(time_starttransfer % 1000000));
         }
         if(time_starttransfer > time_total) {
-          fprintf(moo, "starttransfer vs total: %f %f\n",
-                  time_starttransfer, time_total);
+          fprintf(moo, "starttransfer vs total: %" CURL_FORMAT_CURL_OFF_T
+                  ".%06ld %" CURL_FORMAT_CURL_OFF_T ".%06ld\n",
+                  (time_starttransfer / 1000000),
+                  (long)(time_starttransfer % 1000000),
+                  (time_total / 1000000), (long)(time_total % 1000000));
         }
 
         fclose(moo);
diff --git a/tests/libtest/lib506.c b/tests/libtest/lib506.c
index 1b522be64..5ed4f37ea 100644
--- a/tests/libtest/lib506.c
+++ b/tests/libtest/lib506.c
@@ -131,7 +131,6 @@ static void *fire(void *ptr)
   struct curl_slist *headers;
   struct Tdata *tdata = (struct Tdata*)ptr;
   CURL *curl;
-  int i = 0;
 
   curl = curl_easy_init();
   if(!curl) {
@@ -149,6 +148,7 @@ static void *fire(void *ptr)
   printf("PERFORM\n");
   code = curl_easy_perform(curl);
   if(code) {
+    int i = 0;
     fprintf(stderr, "perform url '%s' repeat %d failed, curlcode %d\n",
             tdata->url, i, (int)code);
   }
diff --git a/tests/libtest/lib512.c b/tests/libtest/lib512.c
index 14241dd02..0c83ddd53 100644
--- a/tests/libtest/lib512.c
+++ b/tests/libtest/lib512.c
@@ -29,15 +29,13 @@
 int test(char *URL)
 {
   CURLcode code;
-  CURL *curl;
-  CURL *curl2;
   int rc = 99;
 
   code = curl_global_init(CURL_GLOBAL_ALL);
   if(code == CURLE_OK) {
-
-    curl = curl_easy_init();
+    CURL *curl = curl_easy_init();
     if(curl) {
+      CURL *curl2;
 
       curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
       curl_easy_setopt(curl, CURLOPT_HEADER, 1L);
diff --git a/tests/libtest/lib544.c b/tests/libtest/lib544.c
index cb1aefc87..60de7fc67 100644
--- a/tests/libtest/lib544.c
+++ b/tests/libtest/lib544.c
@@ -61,7 +61,7 @@ int test(char *URL)
   test_setopt(curl, CURLOPT_URL, URL);
 
 #ifdef LIB545
-  test_setopt(curl, CURLOPT_POSTFIELDSIZE, (long) sizeof teststring);
+  test_setopt(curl, CURLOPT_POSTFIELDSIZE, (long) sizeof(teststring));
 #endif
 
   test_setopt(curl, CURLOPT_COPYPOSTFIELDS, teststring);
diff --git a/tests/libtest/lib552.c b/tests/libtest/lib552.c
index 83797f3c2..7a960417d 100644
--- a/tests/libtest/lib552.c
+++ b/tests/libtest/lib552.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+ * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -185,7 +185,7 @@ int test(char *URL)
 
   /* setup repeated data string */
   for(i = 0; i < sizeof(databuf); ++i)
-      databuf[i] = fill[i % sizeof fill];
+    databuf[i] = fill[i % sizeof(fill)];
 
   /* Post */
   test_setopt(curl, CURLOPT_POST, 1L);
diff --git a/tests/libtest/lib556.c b/tests/libtest/lib556.c
index acb0f63d1..884f413aa 100644
--- a/tests/libtest/lib556.c
+++ b/tests/libtest/lib556.c
@@ -71,7 +71,6 @@ int test(char *URL)
       "Host: ninja\r\n\r\n";
 #endif
     size_t iolen;
-    char buf[1024];
 
     res = curl_easy_send(curl, request, strlen(request), &iolen);
 
@@ -79,6 +78,7 @@ int test(char *URL)
       /* we assume that sending always work */
 
       do {
+        char buf[1024];
         /* busy-read like crazy */
         res = curl_easy_recv(curl, buf, sizeof(buf), &iolen);
 
diff --git a/tests/libtest/lib579.c b/tests/libtest/lib579.c
index cba4b1cb4..4977a03cb 100644
--- a/tests/libtest/lib579.c
+++ b/tests/libtest/lib579.c
@@ -39,7 +39,6 @@ struct WriteThis {
 static int progress_callback(void *clientp, double dltotal, double dlnow,
                              double ultotal, double ulnow)
 {
-  FILE *moo;
   static int prev_ultotal = -1;
   static int prev_ulnow = -1;
   (void)clientp; /* UNUSED */
@@ -53,7 +52,7 @@ static int progress_callback(void *clientp, double dltotal, 
double dlnow,
   if((prev_ultotal != (int)ultotal) ||
      (prev_ulnow != (int)ulnow)) {
 
-    moo = fopen(libtest_arg2, "ab");
+    FILE *moo = fopen(libtest_arg2, "ab");
     if(moo) {
       fprintf(moo, "Progress callback called with UL %d out of %d\n",
               (int)ulnow, (int)ultotal);
diff --git a/tests/libtest/lib586.c b/tests/libtest/lib586.c
index 669f71c15..a831b83d4 100644
--- a/tests/libtest/lib586.c
+++ b/tests/libtest/lib586.c
@@ -99,7 +99,6 @@ static void *fire(void *ptr)
   CURLcode code;
   struct Tdata *tdata = (struct Tdata*)ptr;
   CURL *curl;
-  int i = 0;
 
   curl = curl_easy_init();
   if(!curl) {
@@ -116,6 +115,7 @@ static void *fire(void *ptr)
   printf("PERFORM\n");
   code = curl_easy_perform(curl);
   if(code != CURLE_OK) {
+    int i = 0;
     fprintf(stderr, "perform url '%s' repeat %d failed, curlcode %d\n",
             tdata->url, i, (int)code);
   }
diff --git a/tests/libtest/lib650.c b/tests/libtest/lib650.c
index da1fd5672..056270cfb 100644
--- a/tests/libtest/lib650.c
+++ b/tests/libtest/lib650.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+ * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -153,7 +153,7 @@ int test(char *URL)
   curl_formget(formpost, (void *) &formlength, count_chars);
 
   /* Include length in data for external check. */
-  curl_msnprintf(flbuf, sizeof flbuf, "%lu", (unsigned long) formlength);
+  curl_msnprintf(flbuf, sizeof(flbuf), "%lu", (unsigned long) formlength);
   formrc = curl_formadd(&formpost,
                         &lastptr,
                         CURLFORM_COPYNAME, "formlength",
diff --git a/tests/libtest/lib652.c b/tests/libtest/lib652.c
index d60390b2f..5c9cba5fb 100644
--- a/tests/libtest/lib652.c
+++ b/tests/libtest/lib652.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2017, Daniel Stenberg, <address@hidden>, et al.
+ * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -75,7 +75,7 @@ int test(char *URL)
     fprintf(stderr, "curl_mime_type() failed\n");
     goto test_cleanup;
   }
-  res = curl_mime_data(part, buffer, sizeof buffer);
+  res = curl_mime_data(part, buffer, sizeof(buffer));
   if(res) {
     fprintf(stderr, "curl_mime_data() failed\n");
     goto test_cleanup;
diff --git a/tests/libtest/stub_gssapi.c b/tests/libtest/stub_gssapi.c
index 883cc1900..aaa7796b3 100644
--- a/tests/libtest/stub_gssapi.c
+++ b/tests/libtest/stub_gssapi.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 2017, Daniel Stenberg, <address@hidden>, et al.
+ * Copyright (C) 2017-2018, Daniel Stenberg, <address@hidden>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -82,6 +82,12 @@ OM_uint32 gss_init_sec_context(OM_uint32 *min,
   const char *creds = NULL;
   gss_ctx_id_t ctx = NULL;
 
+  (void)initiator_cred_handle;
+  (void)mech_type;
+  (void)time_req;
+  (void)input_chan_bindings;
+  (void)actual_mech_type;
+
   if(!min)
     return GSS_S_FAILURE;
 
@@ -221,6 +227,8 @@ OM_uint32 gss_delete_sec_context(OM_uint32 *min,
                                  gss_ctx_id_t *context_handle,
                                  gss_buffer_t output_token)
 {
+  (void)output_token;
+
   if(!min)
     return GSS_S_FAILURE;
 
@@ -256,6 +264,7 @@ OM_uint32 gss_import_name(OM_uint32 *min,
                           gss_name_t *output_name)
 {
   char *name = NULL;
+  (void)input_name_type;
 
   if(!min)
     return GSS_S_FAILURE;
@@ -297,6 +306,7 @@ OM_uint32 gss_display_status(OM_uint32 *min,
                              gss_buffer_t status_string)
 {
   const char maj_str[] = "Stub GSS error";
+  (void)mech_type;
   if(min)
     *min = 0;
 
@@ -337,6 +347,10 @@ OM_uint32 gss_display_name(OM_uint32 *min,
                            gss_buffer_t output_name_buffer,
                            gss_OID *output_name_type)
 {
+  (void)min;
+  (void)input_name;
+  (void)output_name_buffer;
+  (void)output_name_type;
   return GSS_S_FAILURE;
 }
 
@@ -350,6 +364,15 @@ OM_uint32 gss_inquire_context(OM_uint32 *min,
                               int *locally_initiated,
                               int *open_context)
 {
+  (void)min;
+  (void)context_handle;
+  (void)src_name;
+  (void)targ_name;
+  (void)lifetime_rec;
+  (void)mech_type;
+  (void)ctx_flags;
+  (void)locally_initiated;
+  (void)open_context;
   return GSS_S_FAILURE;
 }
 
@@ -361,6 +384,13 @@ OM_uint32 gss_wrap(OM_uint32 *min,
                    int *conf_state,
                    gss_buffer_t output_message_buffer)
 {
+  (void)min;
+  (void)context_handle;
+  (void)conf_req_flag;
+  (void)qop_req;
+  (void)input_message_buffer;
+  (void)conf_state;
+  (void)output_message_buffer;
   return GSS_S_FAILURE;
 }
 
@@ -371,6 +401,12 @@ OM_uint32 gss_unwrap(OM_uint32 *min,
                      int *conf_state,
                      gss_qop_t *qop_state)
 {
+  (void)min;
+  (void)context_handle;
+  (void)input_message_buffer;
+  (void)output_message_buffer;
+  (void)conf_state;
+  (void)qop_state;
   return GSS_S_FAILURE;
 }
 
@@ -382,6 +418,13 @@ OM_uint32 gss_seal(OM_uint32 *min,
                    int *conf_state,
                    gss_buffer_t output_message_buffer)
 {
+  (void)min;
+  (void)context_handle;
+  (void)conf_req_flag;
+  (void)qop_req;
+  (void)input_message_buffer;
+  (void)conf_state;
+  (void)output_message_buffer;
   return GSS_S_FAILURE;
 }
 
@@ -392,6 +435,11 @@ OM_uint32 gss_unseal(OM_uint32 *min,
                      int *conf_state,
                      int *qop_state)
 {
+  (void)min;
+  (void)context_handle;
+  (void)input_message_buffer;
+  (void)output_message_buffer;
+  (void)conf_state;
+  (void)qop_state;
   return GSS_S_FAILURE;
 }
-
diff --git a/tests/libtest/testtrace.c b/tests/libtest/testtrace.c
index 63e022b33..3f9eedd80 100644
--- a/tests/libtest/testtrace.c
+++ b/tests/libtest/testtrace.c
@@ -90,7 +90,6 @@ int libtest_debug_cb(CURL *handle, curl_infotype type,
   struct libtest_trace_cfg *trace_cfg = userp;
   const char *text;
   struct timeval tv;
-  struct tm *now;
   char timebuf[20];
   char *timestr;
   time_t secs;
@@ -101,6 +100,7 @@ int libtest_debug_cb(CURL *handle, curl_infotype type,
   timestr = &timebuf[0];
 
   if(trace_cfg->tracetime) {
+    struct tm *now;
     tv = tutil_tvnow();
     if(!known_offset) {
       epoch_offset = time(NULL) - tv.tv_sec;
diff --git a/tests/runtests.pl b/tests/runtests.pl
index c0a68c272..65a62ebae 100755
--- a/tests/runtests.pl
+++ b/tests/runtests.pl
@@ -4349,6 +4349,7 @@ sub singletest {
         # what parts to cut off from the protocol
         my @strippart = getpart("verify", "strippart");
         my $strip;
+        @strippart = fixarray(@strippart);
         for $strip (@strippart) {
             chomp $strip;
             for(@out) {
diff --git a/tests/server/CMakeLists.txt b/tests/server/CMakeLists.txt
index b85f4b853..a80054477 100644
--- a/tests/server/CMakeLists.txt
+++ b/tests/server/CMakeLists.txt
@@ -31,12 +31,6 @@ function(SETUP_EXECUTABLE TEST_NAME)    # ARGN are the files 
in the test
   endif()
   set_target_properties(${TEST_NAME} PROPERTIES
     PROJECT_LABEL "${TARGET_LABEL_PREFIX}${TEST_NAME}")
-
-  # Add the postfix to the executable since it is not added
-  # automatically as for modules and shared libraries
-  set_target_properties(${TEST_NAME} PROPERTIES
-    DEBUG_POSTFIX "${CMAKE_DEBUG_POSTFIX}")
-
 endfunction()
 
 
diff --git a/tests/server/getpart.c b/tests/server/getpart.c
index d434ba289..044705d06 100644
--- a/tests/server/getpart.c
+++ b/tests/server/getpart.c
@@ -116,7 +116,6 @@ CURLcode Curl_convert_clone(struct Curl_easy *data,
 static int readline(char **buffer, size_t *bufsize, FILE *stream)
 {
   size_t offset = 0;
-  size_t length;
   char *newptr;
 
   if(!*buffer) {
@@ -127,6 +126,7 @@ static int readline(char **buffer, size_t *bufsize, FILE 
*stream)
   }
 
   for(;;) {
+    size_t length;
     int bytestoread = curlx_uztosi(*bufsize - offset);
 
     if(!fgets(*buffer + offset, bytestoread, stream))
diff --git a/tests/server/rtspd.c b/tests/server/rtspd.c
index 8e61a43f3..4519eab60 100644
--- a/tests/server/rtspd.c
+++ b/tests/server/rtspd.c
@@ -340,11 +340,8 @@ static int ProcessRequest(struct httprequest *req)
   static char request[REQUEST_KEYWORD_SIZE];
   static char doc[MAXDOCNAMELEN];
   static char prot_str[5];
-  char logbuf[256];
   int prot_major, prot_minor;
-  char *end;
-  int error;
-  end = strstr(line, END_OF_HEADERS);
+  char *end = strstr(line, END_OF_HEADERS);
 
   logmsg("ProcessRequest() called with testno %ld and line [%s]",
          req->testno, line);
@@ -360,6 +357,7 @@ static int ProcessRequest(struct httprequest *req)
             &prot_major,
             &prot_minor) == 5) {
     char *ptr;
+    char logbuf[256];
 
     if(!strcmp(prot_str, "HTTP")) {
       req->protocol = RPROT_HTTP;
@@ -426,7 +424,7 @@ static int ProcessRequest(struct httprequest *req)
 
       stream = fopen(filename, "rb");
       if(!stream) {
-        error = errno;
+        int error = errno;
         logmsg("fopen() failed with error: %d %s", error, strerror(error));
         logmsg("Error opening file: %s", filename);
         logmsg("Couldn't open test file %ld", req->testno);
@@ -441,11 +439,10 @@ static int ProcessRequest(struct httprequest *req)
         int rtp_channel = 0;
         int rtp_size = 0;
         int rtp_partno = -1;
-        int i = 0;
         char *rtp_scratch = NULL;
 
         /* get the custom server control "commands" */
-        error = getpart(&cmd, &cmdsize, "reply", "servercmd", stream);
+        int error = getpart(&cmd, &cmdsize, "reply", "servercmd", stream);
         fclose(stream);
         if(error) {
           logmsg("getpart() failed with error: %d", error);
@@ -486,6 +483,7 @@ static int ProcessRequest(struct httprequest *req)
                                 &rtp_partno, &rtp_channel, &rtp_size)) {
 
               if(rtp_partno == req->partno) {
+                int i = 0;
                 logmsg("RTP: part %d channel %d size %d",
                        rtp_partno, rtp_channel, rtp_size);
 
@@ -900,11 +898,10 @@ static int send_doc(curl_socket_t sock, struct 
httprequest *req)
   size_t count;
   const char *buffer;
   char *ptr = NULL;
-  FILE *stream;
   char *cmd = NULL;
   size_t cmdsize = 0;
   FILE *dump;
-  bool persistant = TRUE;
+  bool persistent = TRUE;
   bool sendfailure = FALSE;
   size_t responsesize;
   int error = 0;
@@ -912,8 +909,6 @@ static int send_doc(curl_socket_t sock, struct httprequest 
*req)
 
   static char weare[256];
 
-  char partbuf[80]="data";
-
   logmsg("Send response number %ld part %ld", req->testno, req->partno);
 
   switch(req->rcmd) {
@@ -987,7 +982,8 @@ static int send_doc(curl_socket_t sock, struct httprequest 
*req)
   }
   else {
     char *filename = test2file(req->testno);
-
+    char partbuf[80]="data";
+    FILE *stream;
     if(0 != req->partno)
       snprintf(partbuf, sizeof(partbuf), "data%ld", req->partno);
 
@@ -1046,7 +1042,7 @@ static int send_doc(curl_socket_t sock, struct 
httprequest *req)
      connection will be closed after the data has been sent to the requesting
      client... */
   if(strstr(buffer, "swsclose") || !count) {
-    persistant = FALSE;
+    persistent = FALSE;
     logmsg("connection close instruction \"swsclose\" found in response");
   }
   if(strstr(buffer, "swsbounce")) {
@@ -1176,7 +1172,7 @@ static int send_doc(curl_socket_t sock, struct 
httprequest *req)
     } while(ptr && *ptr);
   }
   free(cmd);
-  req->open = persistant;
+  req->open = persistent;
 
   prevtestno = req->testno;
   prevpartno = req->partno;
@@ -1430,7 +1426,7 @@ int main(int argc, char *argv[])
       }
 
       if(req.open)
-        logmsg("=> persistant connection request ended, awaits new request");
+        logmsg("=> persistent connection request ended, awaits new request");
       /* if we got a CONNECT, loop and get another request as well! */
     } while(req.open || (req.testno == DOCNUMBER_CONNECT));
 
diff --git a/tests/server/sockfilt.c b/tests/server/sockfilt.c
index 844d35a4e..2fb947f15 100644
--- a/tests/server/sockfilt.c
+++ b/tests/server/sockfilt.c
@@ -358,11 +358,11 @@ static ssize_t write_wincon(int fd, const void *buf, 
size_t count)
 static ssize_t fullread(int filedes, void *buffer, size_t nbytes)
 {
   int error;
-  ssize_t rc;
   ssize_t nread = 0;
 
   do {
-    rc = read(filedes, (unsigned char *)buffer + nread, nbytes - nread);
+    ssize_t rc = read(filedes,
+                      (unsigned char *)buffer + nread, nbytes - nread);
 
     if(got_exit_signal) {
       logmsg("signalled to die");
@@ -404,12 +404,11 @@ static ssize_t fullread(int filedes, void *buffer, size_t 
nbytes)
 static ssize_t fullwrite(int filedes, const void *buffer, size_t nbytes)
 {
   int error;
-  ssize_t wc;
   ssize_t nwrite = 0;
 
   do {
-    wc = write(filedes, (const unsigned char *)buffer + nwrite,
-               nbytes - nwrite);
+    ssize_t wc = write(filedes, (const unsigned char *)buffer + nwrite,
+                       nbytes - nwrite);
 
     if(got_exit_signal) {
       logmsg("signalled to die");
@@ -699,8 +698,6 @@ static int select_ws(int nfds, fd_set *readfds, fd_set 
*writefds,
   WSANETWORKEVENTS wsanetevents;
   struct select_ws_data *data;
   HANDLE handle, *handles;
-  curl_socket_t sock;
-  long networkevents;
   WSAEVENT wsaevent;
   int error, fds;
   HANDLE waitevent = NULL;
@@ -729,6 +726,7 @@ static int select_ws(int nfds, fd_set *readfds, fd_set 
*writefds,
   /* allocate internal array for the internal data */
   data = calloc(nfds, sizeof(struct select_ws_data));
   if(data == NULL) {
+    CloseHandle(waitevent);
     errno = ENOMEM;
     return -1;
   }
@@ -736,6 +734,7 @@ static int select_ws(int nfds, fd_set *readfds, fd_set 
*writefds,
   /* allocate internal array for the internal event handles */
   handles = calloc(nfds, sizeof(HANDLE));
   if(handles == NULL) {
+    CloseHandle(waitevent);
     free(data);
     errno = ENOMEM;
     return -1;
@@ -743,7 +742,7 @@ static int select_ws(int nfds, fd_set *readfds, fd_set 
*writefds,
 
   /* loop over the handles in the input descriptor sets */
   for(fds = 0; fds < nfds; fds++) {
-    networkevents = 0;
+    long networkevents = 0;
     handles[nfd] = 0;
 
     if(FD_ISSET(fds, readfds))
@@ -812,8 +811,8 @@ static int select_ws(int nfds, fd_set *readfds, fd_set 
*writefds,
 
   /* loop over the internal handles returned in the descriptors */
   for(idx = 0; idx < nfd; idx++) {
+    curl_socket_t sock = data[idx].fd;
     handle = handles[idx];
-    sock = data[idx].fd;
     fds = curlx_sktosi(sock);
 
     /* check if the current internal handle was triggered */
@@ -920,9 +919,6 @@ static bool juggle(curl_socket_t *sockfdp,
   curl_socket_t sockfd = CURL_SOCKET_BAD;
   int maxfd = -99;
   ssize_t rc;
-  ssize_t nread_socket;
-  ssize_t bytes_written;
-  ssize_t buffer_len;
   int error = 0;
 
  /* 'buffer' is this excessively large only to be able to support things like
@@ -1034,6 +1030,7 @@ static bool juggle(curl_socket_t *sockfdp,
 
 
   if(FD_ISSET(fileno(stdin), &fds_read)) {
+    ssize_t buffer_len;
     /* read from stdin, commands/data to be dealt with and possibly passed on
        to the socket
 
@@ -1105,7 +1102,7 @@ static bool juggle(curl_socket_t *sockfdp,
       }
       else {
         /* send away on the socket */
-        bytes_written = swrite(sockfd, buffer, buffer_len);
+        ssize_t bytes_written = swrite(sockfd, buffer, buffer_len);
         if(bytes_written != buffer_len) {
           logmsg("Not all data was sent. Bytes to send: %zd sent: %zd",
                  buffer_len, bytes_written);
@@ -1133,13 +1130,11 @@ static bool juggle(curl_socket_t *sockfdp,
 
 
   if((sockfd != CURL_SOCKET_BAD) && (FD_ISSET(sockfd, &fds_read)) ) {
-
-    curl_socket_t newfd = CURL_SOCKET_BAD; /* newly accepted socket */
-
+    ssize_t nread_socket;
     if(*mode == PASSIVE_LISTEN) {
       /* there's no stream set up yet, this is an indication that there's a
          client connecting. */
-      newfd = accept(sockfd, NULL, NULL);
+      curl_socket_t newfd = accept(sockfd, NULL, NULL);
       if(CURL_SOCKET_BAD == newfd) {
         error = SOCKERRNO;
         logmsg("accept(%d, NULL, NULL) failed with error: (%d) %s",
diff --git a/tests/server/sws.c b/tests/server/sws.c
index 10a87746b..ec11224f5 100644
--- a/tests/server/sws.c
+++ b/tests/server/sws.c
@@ -555,7 +555,6 @@ static int ProcessRequest(struct httprequest *req)
       if(sscanf(req->reqbuf, "CONNECT %" MAXDOCNAMELEN_TXT "s HTTP/%d.%d",
                 doc, &prot_major, &prot_minor) == 3) {
         char *portp = NULL;
-        unsigned long part = 0;
 
         snprintf(logbuf, sizeof(logbuf),
                  "Received a CONNECT %s HTTP/%d.%d request",
@@ -569,6 +568,7 @@ static int ProcessRequest(struct httprequest *req)
 
         if(doc[0] == '[') {
           char *p = &doc[1];
+          unsigned long part = 0;
           /* scan through the hexgroups and store the value of the last group
              in the 'part' variable and use as test case number!! */
           while(*p && (ISXDIGIT(*p) || (*p == ':') || (*p == '.'))) {
@@ -954,7 +954,6 @@ static void init_httprequest(struct httprequest *req)
    is no data waiting, or < 0 if it should be closed */
 static int get_request(curl_socket_t sock, struct httprequest *req)
 {
-  int error;
   int fail = 0;
   char *reqbuf = req->reqbuf;
   ssize_t got = 0;
@@ -1000,7 +999,7 @@ static int get_request(curl_socket_t sock, struct 
httprequest *req)
       fail = 1;
     }
     else if(got < 0) {
-      error = SOCKERRNO;
+      int error = SOCKERRNO;
       if(EAGAIN == error || EWOULDBLOCK == error) {
         /* nothing to read at the moment */
         return 0;
@@ -1065,7 +1064,7 @@ static int send_doc(curl_socket_t sock, struct 
httprequest *req)
   char *cmd = NULL;
   size_t cmdsize = 0;
   FILE *dump;
-  bool persistant = TRUE;
+  bool persistent = TRUE;
   bool sendfailure = FALSE;
   size_t responsesize;
   int error = 0;
@@ -1196,7 +1195,7 @@ static int send_doc(curl_socket_t sock, struct 
httprequest *req)
      connection will be closed after the data has been sent to the requesting
      client... */
   if(strstr(buffer, "swsclose") || !count) {
-    persistant = FALSE;
+    persistent = FALSE;
     logmsg("connection close instruction \"swsclose\" found in response");
   }
   if(strstr(buffer, "swsbounce")) {
@@ -1313,7 +1312,7 @@ static int send_doc(curl_socket_t sock, struct 
httprequest *req)
     } while(ptr && *ptr);
   }
   free(cmd);
-  req->open = use_gopher?FALSE:persistant;
+  req->open = use_gopher?FALSE:persistent;
 
   prevtestno = req->testno;
   prevpartno = req->partno;
@@ -1968,7 +1967,7 @@ static int service_connection(curl_socket_t msgsock, 
struct httprequest *req,
   /* if we got a CONNECT, loop and get another request as well! */
 
   if(req->open) {
-    logmsg("=> persistant connection request ended, awaits new request\n");
+    logmsg("=> persistent connection request ended, awaits new request\n");
     return 1;
   }
 
diff --git a/tests/server/testpart.c b/tests/server/testpart.c
index 79869e21c..77f148640 100644
--- a/tests/server/testpart.c
+++ b/tests/server/testpart.c
@@ -30,15 +30,15 @@
 
 int main(int argc, char **argv)
 {
-  int rc;
   char  *part;
-  size_t partlen, i;
+  size_t partlen;
 
   if(argc< 3) {
     printf("./testpart main sub\n");
   }
   else {
-    rc = getpart(&part, &partlen, argv[1], argv[2], stdin);
+    int rc = getpart(&part, &partlen, argv[1], argv[2], stdin);
+    size_t i;
     if(rc)
       return rc;
     for(i = 0; i < partlen; i++)
diff --git a/tests/server/tftpd.c b/tests/server/tftpd.c
index a8b565197..c00731fa2 100644
--- a/tests/server/tftpd.c
+++ b/tests/server/tftpd.c
@@ -955,8 +955,6 @@ static int do_tftp(struct testcase *test, struct tftphdr 
*tp, ssize_t size)
   int first = 1, ecode;
   struct formats *pf;
   char *filename, *mode = NULL;
-  int error;
-  FILE *server;
 #ifdef USE_WINSOCK
   DWORD recvtimeout, recvtimeoutbak;
 #endif
@@ -964,9 +962,9 @@ static int do_tftp(struct testcase *test, struct tftphdr 
*tp, ssize_t size)
   int toggle = 1;
 
   /* Open request dump file. */
-  server = fopen(REQUEST_DUMP, "ab");
+  FILE *server = fopen(REQUEST_DUMP, "ab");
   if(!server) {
-    error = errno;
+    int error = errno;
     logmsg("fopen() failed with error: %d %s", error, strerror(error));
     logmsg("Error opening file: %s", REQUEST_DUMP);
     return -1;
@@ -1138,9 +1136,6 @@ static int validate_access(struct testcase *test,
                            const char *filename, int mode)
 {
   char *ptr;
-  long testno, partno;
-  int error;
-  char partbuf[80]="data";
 
   logmsg("trying to get file: %s mode %x", filename, mode);
 
@@ -1161,6 +1156,9 @@ static int validate_access(struct testcase *test,
   ptr = strrchr(filename, '/');
 
   if(ptr) {
+    char partbuf[80]="data";
+    long partno;
+    long testno;
     char *file;
 
     ptr++; /* skip the slash */
@@ -1194,7 +1192,7 @@ static int validate_access(struct testcase *test,
     if(file) {
       FILE *stream = fopen(file, "rb");
       if(!stream) {
-        error = errno;
+        int error = errno;
         logmsg("fopen() failed with error: %d %s", error, strerror(error));
         logmsg("Error opening file: %s", file);
         logmsg("Couldn't open test file: %s", file);
@@ -1202,7 +1200,7 @@ static int validate_access(struct testcase *test,
       }
       else {
         size_t count;
-        error = getpart(&test->buffer, &count, "reply", partbuf, stream);
+        int error = getpart(&test->buffer, &count, "reply", partbuf, stream);
         fclose(stream);
         if(error) {
           logmsg("getpart() failed with error: %d", error);
diff --git a/tests/server/util.c b/tests/server/util.c
index fdbd71f0f..df681968d 100644
--- a/tests/server/util.c
+++ b/tests/server/util.c
@@ -101,7 +101,6 @@ void logmsg(const char *msg, ...)
   va_list ap;
   char buffer[2048 + 1];
   FILE *logfp;
-  int error;
   struct timeval tv;
   time_t sec;
   struct tm *now;
@@ -135,7 +134,7 @@ void logmsg(const char *msg, ...)
     fclose(logfp);
   }
   else {
-    error = errno;
+    int error = errno;
     fprintf(stderr, "fopen() failed with error: %d %s\n",
             error, strerror(error));
     fprintf(stderr, "Error opening file: %s\n", serverlogfile);
@@ -217,7 +216,6 @@ int wait_ms(int timeout_ms)
 #endif
   struct timeval initial_tv;
   int pending_ms;
-  int error;
 #endif
   int r = 0;
 
@@ -235,6 +233,7 @@ int wait_ms(int timeout_ms)
   pending_ms = timeout_ms;
   initial_tv = tvnow();
   do {
+    int error;
 #if defined(HAVE_POLL_FINE)
     r = poll(NULL, 0, pending_ms);
 #else
diff --git a/tests/unit/Makefile.inc b/tests/unit/Makefile.inc
index ac9d3bd23..665edd856 100644
--- a/tests/unit/Makefile.inc
+++ b/tests/unit/Makefile.inc
@@ -10,7 +10,7 @@ UNITPROGS = unit1300 unit1301 unit1302 unit1303 unit1304 
unit1305 unit1307    \
  unit1330 unit1394 unit1395 unit1396 unit1397 unit1398 \
  unit1399      \
  unit1600 unit1601 unit1602 unit1603 unit1604 unit1605 unit1606 unit1607 \
- unit1608
+ unit1608 unit1609
 
 unit1300_SOURCES = unit1300.c $(UNITFILES)
 unit1300_CPPFLAGS = $(AM_CPPFLAGS)
@@ -92,3 +92,6 @@ unit1607_CPPFLAGS = $(AM_CPPFLAGS)
 
 unit1608_SOURCES = unit1608.c $(UNITFILES)
 unit1608_CPPFLAGS = $(AM_CPPFLAGS)
+
+unit1609_SOURCES = unit1609.c $(UNITFILES)
+unit1609_CPPFLAGS = $(AM_CPPFLAGS)
diff --git a/tests/unit/README b/tests/unit/README
index 301cd17d5..b8a513b3b 100644
--- a/tests/unit/README
+++ b/tests/unit/README
@@ -17,8 +17,8 @@ Run Unit Tests
 
 Unit tests are run as part of the regular test suite. If you have built
 everything to run unit tests, to can do 'make test' at the root level. Or you
-can 'cd tests' and then invoke individual unit tests with ./runtests.pl NNNN
-where NNNN is the specific test number.
+can 'cd tests' and 'make' and then invoke individual unit tests with
+./runtests.pl NNNN where NNNN is the specific test number.
 
 Debug Unit Tests
 ================
diff --git a/tests/unit/unit1300.c b/tests/unit/unit1300.c
index c64fadef9..6030db0d2 100644
--- a/tests/unit/unit1300.c
+++ b/tests/unit/unit1300.c
@@ -264,7 +264,7 @@ UNITTEST_START
   fail_unless(llist_destination.tail != NULL,
           "llist_destination tail set to null after moving an element");
 
-  fail_unless(llist_destination.tail == llist_destination.tail,
+  fail_unless(llist_destination.tail == llist_destination.head,
             "llist_destination tail doesn't equal llist_destination head");
 }
 UNITTEST_STOP
diff --git a/tests/unit/unit1303.c b/tests/unit/unit1303.c
index 75a8e59c2..b065683a6 100644
--- a/tests/unit/unit1303.c
+++ b/tests/unit/unit1303.c
@@ -75,7 +75,6 @@ struct timetest {
 UNITTEST_START
 {
   struct curltime now;
-  time_t timeout;
   unsigned int i;
 
   const struct timetest run[] = {
@@ -139,6 +138,7 @@ UNITTEST_START
   data->progress.t_startop.tv_usec = 0;
 
   for(i = 0; i < sizeof(run)/sizeof(run[0]); i++) {
+    time_t timeout;
     NOW(run[i].now_s, run[i].now_us);
     TIMEOUTS(run[i].timeout_ms, run[i].connecttimeout_ms);
     timeout =  Curl_timeleft(data, &now, run[i].connecting);
diff --git a/tests/unit/unit1307.c b/tests/unit/unit1307.c
index 0d2257bf0..d6664ff69 100644
--- a/tests/unit/unit1307.c
+++ b/tests/unit/unit1307.c
@@ -23,20 +23,46 @@
 
 #include "curl_fnmatch.h"
 
+/*
+   CURL_FNMATCH_MATCH    0
+   CURL_FNMATCH_NOMATCH  1
+   CURL_FNMATCH_FAIL     2
+ */
+
 #define MATCH   CURL_FNMATCH_MATCH
 #define NOMATCH CURL_FNMATCH_NOMATCH
 
+#define LINUX_DIFFER 0x80
+#define LINUX_SHIFT 8
+#define LINUX_MATCH ((CURL_FNMATCH_MATCH << LINUX_SHIFT) | LINUX_DIFFER)
+#define LINUX_NOMATCH ((CURL_FNMATCH_NOMATCH << LINUX_SHIFT) | LINUX_DIFFER)
+#define LINUX_FAIL ((CURL_FNMATCH_FAIL << LINUX_SHIFT) | LINUX_DIFFER)
+
+#define MAC_DIFFER 0x40
+#define MAC_SHIFT 16
+#define MAC_MATCH ((CURL_FNMATCH_MATCH << MAC_SHIFT) | MAC_DIFFER)
+#define MAC_NOMATCH ((CURL_FNMATCH_NOMATCH << MAC_SHIFT) | MAC_DIFFER)
+#define MAC_FAIL ((CURL_FNMATCH_FAIL << MAC_SHIFT) | MAC_DIFFER)
+
 struct testcase {
   const char *pattern;
   const char *string;
-  int  result;
+  int result;
 };
 
 static const struct testcase tests[] = {
   /* brackets syntax */
+  {"*[*[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[["
+   "[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[["
+   "[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[\001\177[[[[[[[[[[[[[[[[[[[[[",
+   "[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[["
+   "[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[["
+   "[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[",
+   NOMATCH|MAC_FAIL},
+
   { "\\[",                      "[",                      MATCH },
-  { "[",                        "[",                      MATCH },
-  { "[]",                       "[]",                     MATCH },
+  { "[",                        "[",             NOMATCH|LINUX_MATCH|MAC_FAIL},
+  { "[]",                       "[]",            NOMATCH|LINUX_MATCH|MAC_FAIL},
   { "[][]",                     "[",                      MATCH },
   { "[][]",                     "]",                      MATCH },
   { "[[]",                      "[",                      MATCH },
@@ -78,7 +104,7 @@ static const struct testcase tests[] = {
   { "[][?*-]",                  "*",                      MATCH },
   { "[][?*-]",                  "-",                      MATCH },
   { "[]?*-]",                   "-",                      MATCH },
-  { "[\xFF]",                   "\xFF",                   MATCH },
+  { "[\xFF]",                   "\xFF", MATCH|LINUX_FAIL|MAC_FAIL},
   { "?/b/c",                    "a/b/c",                  MATCH },
   { "^_{}~",                    "^_{}~",                  MATCH },
   { "!#%+,-./01234567889",      "!#%+,-./01234567889",    MATCH },
@@ -100,9 +126,9 @@ static const struct testcase tests[] = {
   { "*[^a].t?t",                "ba.txt",                 NOMATCH },
   { "*[^a].t?t",                "ab.txt",                 MATCH },
   { "*[^a]",                    "",                       NOMATCH },
-  { "[!\xFF]",                  "",                       NOMATCH },
-  { "[!\xFF]",                  "\xFF",                   NOMATCH },
-  { "[!\xFF]",                  "a",                      MATCH },
+  { "[!\xFF]",                  "",             NOMATCH|LINUX_FAIL},
+  { "[!\xFF]",                  "\xFF",  NOMATCH|LINUX_FAIL|MAC_FAIL},
+  { "[!\xFF]",                  "a",      MATCH|LINUX_FAIL|MAC_FAIL},
   { "[!?*[]",                   "?",                      NOMATCH },
   { "[!!]",                     "!",                      NOMATCH },
   { "[!!]",                     "x",                      MATCH },
@@ -134,8 +160,8 @@ static const struct testcase tests[] = {
   { "[^[:blank:]]",             "\t",                     NOMATCH },
   { "[^[:print:]]",             "\10",                    MATCH },
   { "[[:lower:]][[:lower:]]",   "ll",                     MATCH },
-  { "[[:foo:]]",                "bar",                    NOMATCH },
-  { "[[:foo:]]",                "f]",                     MATCH },
+  { "[[:foo:]]",                "bar",                    NOMATCH|MAC_FAIL},
+  { "[[:foo:]]",                "f]",         MATCH|LINUX_NOMATCH|MAC_FAIL},
 
   { "Curl[[:blank:]];-)",       "Curl ;-)",               MATCH },
   { "*[[:blank:]]*",            " ",                      MATCH },
@@ -173,7 +199,7 @@ static const struct testcase tests[] = {
   { "x",                        "",                       NOMATCH },
 
   /* backslash */
-  { "\\",                       "\\",                     MATCH },
+  { "\\",                       "\\",                     MATCH|LINUX_NOMATCH},
   { "\\\\",                     "\\",                     MATCH },
   { "\\\\",                     "\\\\",                   NOMATCH },
   { "\\?",                      "?",                      MATCH },
@@ -185,11 +211,7 @@ static const struct testcase tests[] = {
   { "\\?.txt",                  "x.txt",                  NOMATCH },
   { "\\*.txt",                  "x.txt",                  NOMATCH },
   { "\\*\\\\.txt",              "*\\.txt",                MATCH },
-  { "*\\**\\?*\\\\*",           "cc*cc?cc\\cc*cc",        MATCH },
   { "*\\**\\?*\\\\*",           "cc*cc?cccc",             NOMATCH },
-  { "*\\**\\?*\\\\*",           "cc*cc?cc\\cc*cc",        MATCH },
-  { "*\\?*\\**",                "cc?c*c",                 MATCH },
-  { "*\\?*\\**curl*",           "cc?c*curl",              MATCH },
   { "*\\?*\\**",                "cc?cc",                  NOMATCH },
   { "\\\"\\$\\&\\'\\(\\)",      "\"$&'()",                MATCH },
   { "\\*\\?\\[\\\\\\`\\|",      "*?[\\`|",                MATCH },
@@ -210,11 +232,11 @@ static const struct testcase tests[] = {
 
   { "Lindmätarv",               "Lindmätarv",             MATCH },
 
-  { "",                         "",                       MATCH },
+  { "",                         "",                       MATCH},
   {"**]*[*[\x13]**[*\x13)]*]*[**[*\x13~r-]*]**[.*]*[\xe3\xe3\xe3\xe3\xe3\xe3"
    "\xe3\xe3\xe3\xe3\xe3\xe3\xe3\xe3\xe3\xe3\xe3\xe3\xe3\xe3\xe3\xe3\xe3\xe3"
    "\xe3\xe3\xe3\xe3\xe3*[\x13]**[*\x13)]*]*[*[\x13]*[~r]*]*\xba\x13\xa6~b-]*",
-                                "a",                      NOMATCH }
+                                "a",                      NOMATCH|LINUX_FAIL}
 };
 
 static CURLcode unit_setup(void)
@@ -226,18 +248,63 @@ static void unit_stop(void)
 {
 }
 
-UNITTEST_START
+static const char *ret2name(int i)
+{
+  switch(i) {
+  case 0:
+    return "MATCH";
+  case 1:
+    return "NOMATCH";
+  case 2:
+    return "FAIL";
+  default:
+    return "unknown";
+  }
+  /* not reached */
+}
 
+enum system {
+  SYSTEM_CUSTOM,
+  SYSTEM_LINUX,
+  SYSTEM_MACOS
+};
+
+UNITTEST_START
+{
   int testnum = sizeof(tests) / sizeof(struct testcase);
-  int i, rc;
+  int i;
+  enum system machine;
+
+#ifdef HAVE_FNMATCH
+  if(strstr(OS, "apple") || strstr(OS, "darwin")) {
+    machine = SYSTEM_MACOS;
+  }
+  else
+    machine = SYSTEM_LINUX;
+  printf("Tested with system fnmatch(), %s-style\n",
+         machine == SYSTEM_LINUX ? "linux" : "mac");
+#else
+  printf("Tested with custom fnmatch()\n");
+  machine = SYSTEM_CUSTOM;
+#endif
 
   for(i = 0; i < testnum; i++) {
-    rc = Curl_fnmatch(NULL, tests[i].pattern, tests[i].string);
-    if(rc != tests[i].result) {
-      printf("Curl_fnmatch(\"%s\", \"%s\") should return %d (returns %d)\n",
-             tests[i].pattern, tests[i].string, tests[i].result, rc);
+    int result = tests[i].result;
+    int rc = Curl_fnmatch(NULL, tests[i].pattern, tests[i].string);
+    if(result & (LINUX_DIFFER|MAC_DIFFER)) {
+      if((result & LINUX_DIFFER) && (machine == SYSTEM_LINUX))
+        result >>= LINUX_SHIFT;
+      else if((result & MAC_DIFFER) && (machine == SYSTEM_MACOS))
+        result >>= MAC_SHIFT;
+      result &= 0x03; /* filter off all high bits */
+    }
+    if(rc != result) {
+      printf("Curl_fnmatch(\"%s\", \"%s\") should return %s (returns %s)"
+             " [%d]\n",
+             tests[i].pattern, tests[i].string, ret2name(result),
+             ret2name(rc), i);
       fail("pattern mismatch");
     }
   }
-
+}
 UNITTEST_STOP
diff --git a/tests/unit/unit1604.c b/tests/unit/unit1604.c
index b414e03e5..fbfd2c423 100644
--- a/tests/unit/unit1604.c
+++ b/tests/unit/unit1604.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2016, Daniel Stenberg, <address@hidden>, et al.
+ * Copyright (C) 1998 - 2018, Daniel Stenberg, <address@hidden>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -295,7 +295,7 @@ UNITTEST_START
 
   size_t i;
 
-  for(i = 0; i < sizeof data / sizeof data[0]; ++i) {
+  for(i = 0; i < sizeof(data) / sizeof(data[0]); ++i) {
     char *output = NULL;
     char *flagstr = NULL;
     char *received_ccstr = NULL;
diff --git a/tests/unit/unit1607.c b/tests/unit/unit1607.c
index 71c59939b..64b6371ee 100644
--- a/tests/unit/unit1607.c
+++ b/tests/unit/unit1607.c
@@ -120,7 +120,7 @@ UNITTEST_START
 
   for(i = 0; i < testnum; ++i, curl_easy_reset(easy)) {
     int j;
-    int addressnum = sizeof tests[i].address / sizeof *tests[i].address;
+    int addressnum = sizeof(tests[i].address) / sizeof(*tests[i].address);
     struct Curl_addrinfo *addr;
     struct Curl_dns_entry *dns;
     struct curl_slist *list;
@@ -199,6 +199,14 @@ UNITTEST_START
         break;
       }
 
+      if(dns->timestamp != 0) {
+        fprintf(stderr, "%s:%d tests[%d] failed. the timestamp is not zero. "
+                "for tests[%d].address[%d\n",
+                __FILE__, __LINE__, i, i, j);
+        problem = true;
+        break;
+      }
+
       addr = addr->ai_next;
     }
 
diff --git a/tests/unit/unit1607.c b/tests/unit/unit1609.c
similarity index 73%
copy from tests/unit/unit1607.c
copy to tests/unit/unit1609.c
index 71c59939b..2b99bee9b 100644
--- a/tests/unit/unit1607.c
+++ b/tests/unit/unit1609.c
@@ -70,47 +70,45 @@ struct testcase {
 };
 
 
-/* In builds without IPv6 support CURLOPT_RESOLVE should skip over those
-   addresses, so we have to do that as well. */
-static const char skip = 0;
-#ifdef ENABLE_IPV6
-#define IPV6ONLY(x) x
-#else
-#define IPV6ONLY(x) &skip
-#endif
-
-/* CURLOPT_RESOLVE address parsing tests */
+/* CURLOPT_RESOLVE address parsing test - to test the following defect fix:
+
+ 1) if there is already existing host:port pair in the DNS cache and
+ we call CURLOPT_RESOLVE, it should also replace addresses.
+ for example, if there is "test.com:80" with address "1.1.1.1"
+ and we called CURLOPT_RESOLVE with address "2.2.2.2", then DNS entry needs to
+ reflect that.
+
+ 2) when cached address is already there and close to expire, then by the
+ time request is made, it can get expired.  This happens because, when
+ we set address using CURLOPT_RESOLVE,
+ it usually marks as permanent (by setting timestamp to zero). However,
+ if address already exists
+in the cache, then it does not mark it, but just leaves it as it is.
+ So we fixing this by timestamp to zero if address already exists too.
+
+Test:
+
+ - insert new entry
+ - verify that timestamp is not zero
+ - call set options with CURLOPT_RESOLVE
+ - then, call Curl_loadhostpairs
+
+ expected result: cached address has zero timestamp.
+
+ - call set options with CURLOPT_RESOLVE with same host:port pair,
+   different address.
+ - then, call Curl_loadhostpairs
+
+ expected result: cached address has zero timestamp and new address
+*/
+
 static const struct testcase tests[] = {
   /* spaces aren't allowed, for now */
-  { "test.com:80:127.0.0.1, 127.0.0.2",
-    "test.com", 80, { NULL, }
-  },
-  { "TEST.com:80:,,127.0.0.1,,,127.0.0.2,,,,::1,,,",
-    "test.com", 80, { "127.0.0.1", "127.0.0.2", IPV6ONLY("::1"), }
-  },
-  { "test.com:80:::1,127.0.0.1",
-    "test.com", 80, { IPV6ONLY("::1"), "127.0.0.1", }
-  },
-  { "test.com:80:[::1],127.0.0.1",
-    "test.com", 80, { IPV6ONLY("::1"), "127.0.0.1", }
-  },
-  { "test.com:80:::1",
-    "test.com", 80, { IPV6ONLY("::1"), }
-  },
-  { "test.com:80:[::1]",
-    "test.com", 80, { IPV6ONLY("::1"), }
-  },
   { "test.com:80:127.0.0.1",
     "test.com", 80, { "127.0.0.1", }
   },
-  { "test.com:80:,127.0.0.1",
-    "test.com", 80, { "127.0.0.1", }
-  },
-  { "test.com:80:127.0.0.1,",
-    "test.com", 80, { "127.0.0.1", }
-  },
-  { "test.com:0:127.0.0.1",
-    "test.com", 0, { "127.0.0.1", }
+  { "test.com:80:127.0.0.2",
+    "test.com", 80, { "127.0.0.2", }
   },
 };
 
@@ -118,22 +116,26 @@ UNITTEST_START
   int i;
   int testnum = sizeof(tests) / sizeof(struct testcase);
 
+/* important: we setup cache outside of the loop
+  and also clean cache after the loop. In contrast,for example,
+  test 1607 sets up and cleans cache on each iteration. */
+  Curl_hostcache_clean(easy, hostcache);
+  easy->dns.hostcache = hostcache;
+  easy->dns.hostcachetype = HCACHE_GLOBAL;
+
   for(i = 0; i < testnum; ++i, curl_easy_reset(easy)) {
     int j;
-    int addressnum = sizeof tests[i].address / sizeof *tests[i].address;
+    int addressnum = sizeof (tests[i].address) / sizeof (*tests[i].address);
     struct Curl_addrinfo *addr;
     struct Curl_dns_entry *dns;
     struct curl_slist *list;
     void *entry_id;
     bool problem = false;
 
-    Curl_hostcache_clean(easy, hostcache);
-    easy->dns.hostcache = hostcache;
-    easy->dns.hostcachetype = HCACHE_GLOBAL;
-
     list = curl_slist_append(NULL, tests[i].optval);
     if(!list)
         goto unit_test_abort;
+
     curl_easy_setopt(easy, CURLOPT_RESOLVE, list);
 
     Curl_loadhostpairs(easy);
@@ -156,9 +158,6 @@ UNITTEST_START
       if(!addr && !tests[i].address[j])
         break;
 
-      if(tests[i].address[j] == &skip)
-        continue;
-
       if(addr && !Curl_getaddressinfo(addr->ai_addr,
                                       ipaddress, &port)) {
         fprintf(stderr, "%s:%d tests[%d] failed. getaddressinfo failed.\n",
@@ -202,7 +201,6 @@ UNITTEST_START
       addr = addr->ai_next;
     }
 
-    Curl_hostcache_clean(easy, easy->dns.hostcache);
     curl_slist_free_all(list);
 
     if(problem) {
@@ -210,4 +208,7 @@ UNITTEST_START
       continue;
     }
   }
+
+  Curl_hostcache_clean(easy, easy->dns.hostcache);
+
 UNITTEST_STOP
diff --git a/winbuild/MakefileBuild.vc b/winbuild/MakefileBuild.vc
index bf79db376..019a414a0 100644
--- a/winbuild/MakefileBuild.vc
+++ b/winbuild/MakefileBuild.vc
@@ -5,7 +5,7 @@
 #                            | (__| |_| |  _ <| |___
 #                             \___|\___/|_| \_\_____|
 #
-# Copyright (C) 1999 - 2017, Daniel Stenberg, <address@hidden>, et al.
+# Copyright (C) 1999 - 2018, Daniel Stenberg, <address@hidden>, et al.
 #
 # This software is licensed as described in the file COPYING, which
 # you should have received as part of this distribution. The terms
@@ -352,6 +352,8 @@ GEN_PDB = true
 
 !IFDEF EMBED_MANIFEST
 MANIFESTTOOL = $(MT) -manifest $(DIRDIST)\bin\$(PROGRAM_NAME).manifest 
-outputresource:$(DIRDIST)\bin\$(PROGRAM_NAME);1
+!ELSE
+CURL_RC_FLAGS = $(CURL_RC_FLAGS) /dCURL_EMBED_MANIFEST
 !ENDIF
 
 # Runtime library configuration
@@ -502,7 +504,7 @@ package: $(TARGET)
        @-$(ZIP) -9 -q -r ..\$(CONFIG_NAME_LIB).zip .>nul 2<&1
        @cd $(MAKEDIR)
 
-$(TARGET): $(LIB_OBJS) $(LIB_DIROBJ) $(DISTDIR)
+$(TARGET): $(LIB_OBJS) $(LIB_DIROBJ) $(DIRDIST)
        @echo Using SSL: $(USE_SSL)
        @echo Using NGHTTP2: $(USE_NGHTTP2)
        @echo Using c-ares: $(USE_CARES)
diff --git a/winbuild/gen_resp_file.bat b/winbuild/gen_resp_file.bat
index 434f36963..c640cee09 100755
--- a/winbuild/gen_resp_file.bat
+++ b/winbuild/gen_resp_file.bat
@@ -1,5 +1,7 @@
 @echo OFF
address@hidden %OUTFILE%
address@hidden exist %OUTFILE% (
+    del %OUTFILE%
+)
 @echo %MACRO_NAME% = \> %OUTFILE%
 @for %%i in (%*) do @echo              %DIROBJ%/%%i \>>  %OUTFILE%
 @echo. >>  %OUTFILE%

-- 
To stop receiving notification emails like this one, please contact
address@hidden



reply via email to

[Prev in Thread] Current Thread [Next in Thread]