1 files changed, 497 insertions, 179 deletions

diff --git a/content/fetchers/curl.c b/content/fetchers/curl.c
index f9cafae69..680e60456 100644
--- a/content/fetchers/curl.c
+++ b/content/fetchers/curl.c
@@ -67,21 +67,38 @@
 #define UPDATES_PER_SECOND 2
 
 /**
- * The ciphersuites the browser is prepared to use
+ * The ciphersuites the browser is prepared to use for TLS1.3
+ */
+#define CIPHER_SUITES						\
+	"TLS_AES_256_GCM_SHA384:"				\
+	"TLS_CHACHA20_POLY1305_SHA256:"				\
+	"TLS_AES_128_GCM_SHA256"
+
+/**
+ * The ciphersuites the browser is prepared to use for TLS<1.3
  */
 #define CIPHER_LIST						\
 	/* disable everything */				\
 	"-ALL:"							\
-	/* enable TLSv1.2 PFS suites */				\
-	"EECDH+AES+TLSv1.2:EDH+AES+TLSv1.2:"			\
-	/* enable PFS AES GCM suites */				\
-	"EECDH+AESGCM:EDH+AESGCM:"				\
-	/* Enable PFS AES CBC suites */				\
-	"EECDH+AES:EDH+AES:"					\
-	/* Enable non-PFS fallback suite */			\
-	"AES128-SHA:"						\
-	/* Remove any PFS suites using weak DSA key exchange */	\
-	"-DSS"
+	/* enable TLSv1.2 ECDHE AES GCM suites */		\
+	"EECDH+AESGCM+TLSv1.2:"					\
+	/* enable ECDHE CHACHA20/POLY1305 suites */		\
+	"EECDH+CHACHA20:"					\
+	/* Sort above by strength */				\
+	"@STRENGTH:"						\
+	/* enable ECDHE (auth=RSA, mac=SHA1) AES CBC suites */	\
+	"EECDH+aRSA+AES+SHA1"
+
+/**
+ * The legacy cipher suites the browser is prepared to use for TLS<1.3
+ */
+#define CIPHER_LIST_LEGACY					\
+	/* as above */						\
+	CIPHER_LIST":"						\
+	/* enable (non-PFS) RSA AES GCM suites */		\
+	"RSA+AESGCM:"						\
+	/* enable (non-PFS) RSA (mac=SHA1) AES CBC suites */	\
+	"RSA+AES+SHA1"
 
 /* Open SSL compatability for certificate handling */
 #ifdef WITH_OPENSSL
@@ -89,33 +106,11 @@
 #include <openssl/ssl.h>
 #include <openssl/x509v3.h>
 
-/* OpenSSL 1.0.x to 1.1.0 certificate reference counting changed
- * LibreSSL declares its OpenSSL version as 2.1 but only supports the old way
- */
-#if (defined(LIBRESSL_VERSION_NUMBER) || (OPENSSL_VERSION_NUMBER < 0x1010000fL))
-static int ns_X509_up_ref(X509 *cert)
-{
-	cert->references++;
-	return 1;
-}
-
-static void ns_X509_free(X509 *cert)
-{
-	cert->references--;
-	if (cert->references == 0) {
-		X509_free(cert);
-	}
-}
-#else
-#define ns_X509_up_ref X509_up_ref
-#define ns_X509_free X509_free
-#endif
-
 #else /* WITH_OPENSSL */
 
 typedef char X509;
 
-static void ns_X509_free(X509 *cert)
+static void X509_free(X509 *cert)
 {
 	free(cert);
 }
@@ -216,6 +211,26 @@ struct cert_info {
 	long err;		/**< OpenSSL error code */
 };
 
+#if LIBCURL_VERSION_NUM >= 0x072000 /* 7.32.0 depricated CURLOPT_PROGRESSFUNCTION*/
+#define NSCURLOPT_PROGRESS_FUNCTION CURLOPT_XFERINFOFUNCTION
+#define NSCURLOPT_PROGRESS_DATA CURLOPT_XFERINFODATA
+#define NSCURL_PROGRESS_T curl_off_t
+#else
+#define NSCURLOPT_PROGRESS_FUNCTION CURLOPT_PROGRESSFUNCTION
+#define NSCURLOPT_PROGRESS_DATA CURLOPT_PROGRESSDATA
+#define NSCURL_PROGRESS_T double
+#endif
+
+#if LIBCURL_VERSION_NUM >= 0x073800 /* 7.56.0 depricated curl_formadd */
+#define NSCURL_POSTDATA_T curl_mime
+#define NSCURL_POSTDATA_CURLOPT CURLOPT_MIMEPOST
+#define NSCURL_POSTDATA_FREE(x) curl_mime_free(x)
+#else
+#define NSCURL_POSTDATA_T struct curl_httppost
+#define NSCURL_POSTDATA_CURLOPT CURLOPT_HTTPPOST
+#define NSCURL_POSTDATA_FREE(x) curl_formfree(x)
+#endif
+
 /** Information for a single fetch. */
 struct curl_fetch_info {
 	struct fetch *fetch_handle; /**< The fetch handle we're parented by. */
@@ -225,7 +240,7 @@ struct curl_fetch_info {
 	bool abort;		/**< Abort requested. */
 	bool stopped;		/**< Download stopped on purpose. */
 	bool only_2xx;		/**< Only HTTP 2xx responses acceptable. */
-	bool downgrade_tls;	/**< Downgrade to TLS <= 1.0 */
+	bool downgrade_tls;	/**< Downgrade to TLS 1.2 */
 	nsurl *url;		/**< URL of this fetch. */
 	lwc_string *host;	/**< The hostname of this fetch. */
 	struct curl_slist *headers;	/**< List of request headers. */
@@ -233,9 +248,11 @@ struct curl_fetch_info {
 	unsigned long content_length;	/**< Response Content-Length, or 0. */
 	char *cookie_string;	/**< Cookie string for this fetch */
 	char *realm;		/**< HTTP Auth Realm */
-	char *post_urlenc;	/**< Url encoded POST string, or 0. */
+	struct fetch_postdata *postdata; /**< POST data */
+	NSCURL_POSTDATA_T *curl_postdata; /**< POST data in curl representation */
+
 	long http_code; /**< HTTP result code from cURL. */
-	struct curl_httppost *post_multipart;	/**< Multipart post data, or 0. */
+
 	uint64_t last_progress_update;	/**< Time of last progress update */
 	int cert_depth; /**< deepest certificate in use */
 	struct cert_info cert_data[MAX_CERT_DEPTH]; /**< HTTPS certificate data */
@@ -342,85 +359,95 @@ static bool fetch_curl_can_fetch(const nsurl *url)
 }
 
 
+
 /**
- * Convert a list of struct ::fetch_multipart_data to a list of
- * struct curl_httppost for libcurl.
+ * allocate postdata
  */
-static struct curl_httppost *
-fetch_curl_post_convert(const struct fetch_multipart_data *control)
+static struct fetch_postdata *
+fetch_curl_alloc_postdata(const char *post_urlenc,
+			  const struct fetch_multipart_data *post_multipart)
 {
-	struct curl_httppost *post = 0, *last = 0;
-	CURLFORMcode code;
-	nserror ret;
-
-	for (; control; control = control->next) {
-		if (control->file) {
-			char *leafname = NULL;
-			ret = guit->file->basename(control->value, &leafname, NULL);
-			if (ret != NSERROR_OK) {
-				continue;
+	struct fetch_postdata *postdata;
+	postdata = calloc(1, sizeof(struct fetch_postdata));
+	if (postdata != NULL) {
+
+		if (post_urlenc) {
+			postdata->type = FETCH_POSTDATA_URLENC;
+			postdata->data.urlenc = strdup(post_urlenc);
+			if (postdata->data.urlenc == NULL) {
+				free(postdata);
+				postdata = NULL;
 			}
-
-			/* We have to special case filenames of "", so curl
-			 * a) actually attempts the fetch and
-			 * b) doesn't attempt to open the file ""
-			 */
-			if (control->value[0] == '\0') {
-				/* dummy buffer - needs to be static so
-				 * pointer's still valid when we go out
-				 * of scope (not that libcurl should be
-				 * attempting to access it, of course).
-				 */
-				static char buf;
-
-				code = curl_formadd(&post, &last,
-					CURLFORM_COPYNAME, control->name,
-					CURLFORM_BUFFER, control->value,
-					/* needed, as basename("") == "." */
-					CURLFORM_FILENAME, "",
-					CURLFORM_BUFFERPTR, &buf,
-					CURLFORM_BUFFERLENGTH, 0,
-					CURLFORM_CONTENTTYPE,
-						"application/octet-stream",
-					CURLFORM_END);
-				if (code != CURL_FORMADD_OK)
-					NSLOG(netsurf, INFO,
-					      "curl_formadd: %d (%s)", code,
-					      control->name);
-			} else {
-				char *mimetype = guit->fetch->mimetype(control->value);
-				code = curl_formadd(&post, &last,
-					CURLFORM_COPYNAME, control->name,
-					CURLFORM_FILE, control->rawfile,
-					CURLFORM_FILENAME, leafname,
-					CURLFORM_CONTENTTYPE,
-					(mimetype != 0 ? mimetype : "text/plain"),
-					CURLFORM_END);
-				if (code != CURL_FORMADD_OK)
-					NSLOG(netsurf, INFO,
-					      "curl_formadd: %d (%s=%s)",
-					      code,
-					      control->name,
-					      control->value);
-				free(mimetype);
+		} else if (post_multipart) {
+			postdata->type = FETCH_POSTDATA_MULTIPART;
+			postdata->data.multipart = fetch_multipart_data_clone(post_multipart);
+			if (postdata->data.multipart == NULL) {
+				free(postdata);
+				postdata = NULL;
 			}
-			free(leafname);
-		}
-		else {
-			code = curl_formadd(&post, &last,
-					CURLFORM_COPYNAME, control->name,
-					CURLFORM_COPYCONTENTS, control->value,
-					CURLFORM_END);
-			if (code != CURL_FORMADD_OK)
-				NSLOG(netsurf, INFO,
-				      "curl_formadd: %d (%s=%s)", code,
-				      control->name, control->value);
+		} else {
+			postdata->type = FETCH_POSTDATA_NONE;
 		}
 	}
+	return postdata;
+}
 
-	return post;
+/**
+ * free postdata
+ */
+static void fetch_curl_free_postdata(struct fetch_postdata *postdata)
+{
+	if (postdata != NULL) {
+		switch (postdata->type) {
+		case FETCH_POSTDATA_NONE:
+			break;
+		case FETCH_POSTDATA_URLENC:
+			free(postdata->data.urlenc);
+			break;
+		case FETCH_POSTDATA_MULTIPART:
+			fetch_multipart_data_destroy(postdata->data.multipart);
+			break;
+		}
+
+		free(postdata);
+	}
 }
 
+/**
+ *construct a new fetch structure
+ */
+static struct curl_fetch_info *fetch_alloc(void)
+{
+	struct curl_fetch_info *fetch;
+	fetch = malloc(sizeof (*fetch));
+	if (fetch == NULL)
+		return NULL;
+
+	fetch->curl_handle = NULL;
+	fetch->sent_ssl_chain = false;
+	fetch->had_headers = false;
+	fetch->abort = false;
+	fetch->stopped = false;
+	fetch->only_2xx = false;
+	fetch->downgrade_tls = false;
+	fetch->headers = NULL;
+	fetch->url = NULL;
+	fetch->host = NULL;
+	fetch->location = NULL;
+	fetch->content_length = 0;
+	fetch->http_code = 0;
+	fetch->cookie_string = NULL;
+	fetch->realm = NULL;
+	fetch->last_progress_update = 0;
+	fetch->postdata = NULL;
+	fetch->curl_postdata = NULL;
+
+	/* Clear certificate chain data */
+	memset(fetch->cert_data, 0, sizeof(fetch->cert_data));
+	fetch->cert_depth = -1;
+
+	return fetch;
+}
 
 /**
  * Start fetching data for the given URL.
@@ -456,46 +483,22 @@ fetch_curl_setup(struct fetch *parent_fetch,
 	struct curl_slist *slist;
 	int i;
 
-	fetch = malloc(sizeof (*fetch));
+	fetch = fetch_alloc();
 	if (fetch == NULL)
-		return 0;
-
-	fetch->fetch_handle = parent_fetch;
+		return NULL;
 
 	NSLOG(netsurf, INFO, "fetch %p, url '%s'", fetch, nsurl_access(url));
 
-	/* construct a new fetch structure */
-	fetch->curl_handle = NULL;
-	fetch->sent_ssl_chain = false;
-	fetch->had_headers = false;
-	fetch->abort = false;
-	fetch->stopped = false;
 	fetch->only_2xx = only_2xx;
 	fetch->downgrade_tls = downgrade_tls;
-	fetch->headers = NULL;
+	fetch->fetch_handle = parent_fetch;
 	fetch->url = nsurl_ref(url);
 	fetch->host = nsurl_get_component(url, NSURL_HOST);
-	fetch->location = NULL;
-	fetch->content_length = 0;
-	fetch->http_code = 0;
-	fetch->cookie_string = NULL;
-	fetch->realm = NULL;
-	fetch->post_urlenc = NULL;
-	fetch->post_multipart = NULL;
-	if (post_urlenc) {
-		fetch->post_urlenc = strdup(post_urlenc);
-	} else if (post_multipart) {
-		fetch->post_multipart = fetch_curl_post_convert(post_multipart);
+	if (fetch->host == NULL) {
+		goto failed;
 	}
-	fetch->last_progress_update = 0;
-
-	/* Clear certificate chain data */
-	memset(fetch->cert_data, 0, sizeof(fetch->cert_data));
-	fetch->cert_depth = -1;
-
-	if ((fetch->host == NULL) ||
-	    (post_multipart != NULL && fetch->post_multipart == NULL) ||
-	    (post_urlenc != NULL && fetch->post_urlenc == NULL)) {
+	fetch->postdata = fetch_curl_alloc_postdata(post_urlenc, post_multipart);
+	if (fetch->postdata == NULL) {
 		goto failed;
 	}
 
@@ -548,9 +551,7 @@ failed:
 		lwc_string_unref(fetch->host);
 
 	nsurl_unref(fetch->url);
-	free(fetch->post_urlenc);
-	if (fetch->post_multipart)
-		curl_formfree(fetch->post_multipart);
+	fetch_curl_free_postdata(fetch->postdata);
 	curl_slist_free_all(fetch->headers);
 	free(fetch);
 	return NULL;
@@ -730,7 +731,7 @@ fetch_curl_verify_callback(int verify_ok, X509_STORE_CTX *x509_ctx)
 	 */
 	if (!fetch->cert_data[depth].cert) {
 		fetch->cert_data[depth].cert = X509_STORE_CTX_get_current_cert(x509_ctx);
-		ns_X509_up_ref(fetch->cert_data[depth].cert);
+		X509_up_ref(fetch->cert_data[depth].cert);
 		fetch->cert_data[depth].err = X509_STORE_CTX_get_error(x509_ctx);
 	}
 
@@ -805,7 +806,8 @@ fetch_curl_sslctxfun(CURL *curl_handle, void *_sslctx, void *parm)
 {
 	struct curl_fetch_info *f = (struct curl_fetch_info *) parm;
 	SSL_CTX *sslctx = _sslctx;
-	long options = SSL_OP_ALL | SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3;
+	long options = SSL_OP_ALL | SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 |
+			SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1;
 
 	/* set verify callback for each certificate in chain */
 	SSL_CTX_set_verify(sslctx, SSL_VERIFY_PEER, fetch_curl_verify_callback);
@@ -816,19 +818,14 @@ fetch_curl_sslctxfun(CURL *curl_handle, void *_sslctx, void *parm)
 					 parm);
 
 	if (f->downgrade_tls) {
-		/* Disable TLS 1.1/1.2 if the server can't cope with them */
-#ifdef SSL_OP_NO_TLSv1_1
-		options |= SSL_OP_NO_TLSv1_1;
-#endif
-#ifdef SSL_OP_NO_TLSv1_2
-		options |= SSL_OP_NO_TLSv1_2;
+		/* Disable TLS 1.3 if the server can't cope with it */
+#ifdef SSL_OP_NO_TLSv1_3
+		options |= SSL_OP_NO_TLSv1_3;
 #endif
 #ifdef SSL_MODE_SEND_FALLBACK_SCSV
 		/* Ensure server rejects the connection if downgraded too far */
 		SSL_CTX_set_mode(sslctx, SSL_MODE_SEND_FALLBACK_SCSV);
 #endif
-		/* Disable TLS1.2 ciphersuites */
-		SSL_CTX_set_cipher_list(sslctx, CIPHER_LIST ":-TLSv1.2");
 	}
 
 	SSL_CTX_set_options(sslctx, options);
@@ -865,6 +862,301 @@ fetch_curl_report_certs_upstream(struct curl_fetch_info *f)
 	f->sent_ssl_chain = true;
 }
 
+#if LIBCURL_VERSION_NUM >= 0x073800 /* 7.56.0 depricated curl_formadd */
+
+/**
+ * curl mime data context
+ */
+struct curl_mime_ctx {
+	char *buffer;
+	curl_off_t size;
+	curl_off_t position;
+};
+
+static size_t mime_data_read_callback(char *buffer, size_t size, size_t nitems, void *arg)
+{
+	struct curl_mime_ctx *mctx = (struct curl_mime_ctx *) arg;
+	curl_off_t sz = mctx->size - mctx->position;
+
+	nitems *= size;
+	if(sz > (curl_off_t)nitems) {
+		sz = nitems;
+	}
+	if(sz) {
+		memcpy(buffer, mctx->buffer + mctx->position, sz);
+	}
+	mctx->position += sz;
+	return sz;
+}
+
+static int mime_data_seek_callback(void *arg, curl_off_t offset, int origin)
+{
+	struct curl_mime_ctx *mctx = (struct curl_mime_ctx *) arg;
+
+	switch(origin) {
+	case SEEK_END:
+		offset += mctx->size;
+		break;
+	case SEEK_CUR:
+		offset += mctx->position;
+		break;
+	}
+
+	if(offset < 0) {
+		return CURL_SEEKFUNC_FAIL;
+	}
+	mctx->position = offset;
+	return CURL_SEEKFUNC_OK;
+}
+
+static void mime_data_free_callback(void *arg)
+{
+	struct curl_mime_ctx *mctx = (struct curl_mime_ctx *) arg;
+	free(mctx);
+}
+
+/**
+ * Convert a POST data list to a libcurl curl_mime.
+ *
+ * \param chandle curl fetch handle.
+ * \param multipart limked list of struct ::fetch_multipart forming post data.
+ */
+static curl_mime *
+fetch_curl_postdata_convert(CURL *chandle,
+			    const struct fetch_multipart_data *multipart)
+{
+	curl_mime *cmime;
+	curl_mimepart *part;
+	CURLcode code = CURLE_OK;
+	size_t value_len;
+
+	cmime = curl_mime_init(chandle);
+	if (cmime == NULL) {
+		NSLOG(netsurf, WARNING, "postdata conversion failed to curl mime context");
+		return NULL;
+	}
+
+	/* iterate post data */
+	for (; multipart != NULL; multipart = multipart->next) {
+		part = curl_mime_addpart(cmime);
+		if (part == NULL) {
+			goto convert_failed;
+		}
+
+		code = curl_mime_name(part, multipart->name);
+		if (code != CURLE_OK) {
+			goto convert_failed;
+		}
+
+		value_len = strlen(multipart->value);
+
+		if (multipart->file && value_len==0) {
+			/* file entries with no filename require special handling */
+			code=curl_mime_data(part, multipart->value, value_len);
+			if (code != CURLE_OK) {
+				goto convert_failed;
+			}
+
+			code = curl_mime_filename(part, "");
+			if (code != CURLE_OK) {
+				goto convert_failed;
+			}
+
+			code = curl_mime_type(part, "application/octet-stream");
+			if (code != CURLE_OK) {
+				goto convert_failed;
+			}
+
+		} else if(multipart->file) {
+			/* file entry */
+			nserror ret;
+			char *leafname = NULL;
+			char *mimetype = NULL;
+
+			code = curl_mime_filedata(part, multipart->rawfile);
+			if (code != CURLE_OK) {
+				goto convert_failed;
+			}
+
+			ret = guit->file->basename(multipart->value, &leafname, NULL);
+			if (ret != NSERROR_OK) {
+				goto convert_failed;
+			}
+			code = curl_mime_filename(part, leafname);
+			free(leafname);
+			if (code != CURLE_OK) {
+				goto convert_failed;
+			}
+
+			mimetype = guit->fetch->mimetype(multipart->value);
+			if (mimetype == NULL) {
+				mimetype=strdup("text/plain");
+			}
+			if (mimetype == NULL) {
+				goto convert_failed;
+			}
+			code = curl_mime_type(part, mimetype);
+			free(mimetype);
+			if (code != CURLE_OK) {
+				goto convert_failed;
+			}
+
+		} else {
+			/* make the curl mime reference the existing multipart
+			 * data which requires use of a callback and context.
+			 */
+			struct curl_mime_ctx *cb_ctx;
+			cb_ctx = malloc(sizeof(struct curl_mime_ctx));
+			if (cb_ctx == NULL) {
+				goto convert_failed;
+			}
+			cb_ctx->buffer = multipart->value;
+			cb_ctx->size = value_len;
+			cb_ctx->position = 0;
+			code = curl_mime_data_cb(part,
+						 value_len,
+						 mime_data_read_callback,
+						 mime_data_seek_callback,
+						 mime_data_free_callback,
+						 cb_ctx);
+			if (code != CURLE_OK) {
+				free(cb_ctx);
+				goto convert_failed;
+			}
+		}
+	}
+
+	return cmime;
+
+convert_failed:
+	NSLOG(netsurf, WARNING, "postdata conversion failed with curl code: %d", code);
+	curl_mime_free(cmime);
+	return NULL;
+}
+
+#else /* LIBCURL_VERSION_NUM >= 0x073800 */
+
+/**
+ * Convert a list of struct ::fetch_multipart_data to a list of
+ * struct curl_httppost for libcurl.
+ */
+static struct curl_httppost *
+fetch_curl_postdata_convert(CURL *chandle,
+			    const struct fetch_multipart_data *control)
+{
+	struct curl_httppost *post = NULL, *last = NULL;
+	CURLFORMcode code;
+	nserror ret;
+
+	for (; control; control = control->next) {
+		if (control->file) {
+			char *leafname = NULL;
+			ret = guit->file->basename(control->value, &leafname, NULL);
+			if (ret != NSERROR_OK) {
+				continue;
+			}
+
+			/* We have to special case filenames of "", so curl
+			 * a) actually attempts the fetch and
+			 * b) doesn't attempt to open the file ""
+			 */
+			if (control->value[0] == '\0') {
+				/* dummy buffer - needs to be static so
+				 * pointer's still valid when we go out
+				 * of scope (not that libcurl should be
+				 * attempting to access it, of course).
+				 */
+				static char buf;
+
+				code = curl_formadd(&post, &last,
+						    CURLFORM_COPYNAME, control->name,
+						    CURLFORM_BUFFER, control->value,
+						    /* needed, as basename("") == "." */
+						    CURLFORM_FILENAME, "",
+						    CURLFORM_BUFFERPTR, &buf,
+						    CURLFORM_BUFFERLENGTH, 0,
+						    CURLFORM_CONTENTTYPE,
+						    "application/octet-stream",
+						    CURLFORM_END);
+				if (code != CURL_FORMADD_OK)
+					NSLOG(netsurf, INFO,
+					      "curl_formadd: %d (%s)", code,
+					      control->name);
+			} else {
+				char *mimetype = guit->fetch->mimetype(control->value);
+				code = curl_formadd(&post, &last,
+						    CURLFORM_COPYNAME, control->name,
+						    CURLFORM_FILE, control->rawfile,
+						    CURLFORM_FILENAME, leafname,
+						    CURLFORM_CONTENTTYPE,
+						    (mimetype != 0 ? mimetype : "text/plain"),
+						    CURLFORM_END);
+				if (code != CURL_FORMADD_OK)
+					NSLOG(netsurf, INFO,
+					      "curl_formadd: %d (%s=%s)",
+					      code,
+					      control->name,
+					      control->value);
+				free(mimetype);
+			}
+			free(leafname);
+		} else {
+			code = curl_formadd(&post, &last,
+					    CURLFORM_COPYNAME, control->name,
+					    CURLFORM_COPYCONTENTS, control->value,
+					    CURLFORM_END);
+			if (code != CURL_FORMADD_OK)
+				NSLOG(netsurf, INFO,
+				      "curl_formadd: %d (%s=%s)", code,
+				      control->name, control->value);
+		}
+	}
+
+	return post;
+}
+
+#endif  /* LIBCURL_VERSION_NUM >= 0x073800 */
+
+/**
+ * Setup multipart post data
+ */
+static CURLcode fetch_curl_set_postdata(struct curl_fetch_info *f)
+{
+	CURLcode code = CURLE_OK;
+
+#undef SETOPT
+#define SETOPT(option, value) { \
+	code = curl_easy_setopt(f->curl_handle, option, value);	\
+	if (code != CURLE_OK)					\
+		return code;					\
+	}
+
+	switch (f->postdata->type) {
+	case FETCH_POSTDATA_NONE:
+		SETOPT(CURLOPT_POSTFIELDS, NULL);
+		SETOPT(NSCURL_POSTDATA_CURLOPT, NULL);
+		SETOPT(CURLOPT_HTTPGET, 1L);
+		break;
+
+	case FETCH_POSTDATA_URLENC:
+		SETOPT(NSCURL_POSTDATA_CURLOPT, NULL);
+		SETOPT(CURLOPT_HTTPGET, 0L);
+		SETOPT(CURLOPT_POSTFIELDS, f->postdata->data.urlenc);
+		break;
+
+	case FETCH_POSTDATA_MULTIPART:
+		SETOPT(CURLOPT_POSTFIELDS, NULL);
+		SETOPT(CURLOPT_HTTPGET, 0L);
+		if (f->curl_postdata == NULL) {
+			f->curl_postdata =
+				fetch_curl_postdata_convert(f->curl_handle,
+							    f->postdata->data.multipart);
+		}
+		SETOPT(NSCURL_POSTDATA_CURLOPT, f->curl_postdata);
+		break;
+	}
+	return code;
+}
 
 /**
  * Set options specific for a fetch.
@@ -888,21 +1180,11 @@ static CURLcode fetch_curl_set_options(struct curl_fetch_info *f)
 	SETOPT(CURLOPT_PRIVATE, f);
 	SETOPT(CURLOPT_WRITEDATA, f);
 	SETOPT(CURLOPT_WRITEHEADER, f);
-	SETOPT(CURLOPT_PROGRESSDATA, f);
-	SETOPT(CURLOPT_REFERER, fetch_get_referer_to_send(f->fetch_handle));
+	SETOPT(NSCURLOPT_PROGRESS_DATA, f);
 	SETOPT(CURLOPT_HTTPHEADER, f->headers);
-	if (f->post_urlenc) {
-		SETOPT(CURLOPT_HTTPPOST, NULL);
-		SETOPT(CURLOPT_HTTPGET, 0L);
-		SETOPT(CURLOPT_POSTFIELDS, f->post_urlenc);
-	} else if (f->post_multipart) {
-		SETOPT(CURLOPT_POSTFIELDS, NULL);
-		SETOPT(CURLOPT_HTTPGET, 0L);
-		SETOPT(CURLOPT_HTTPPOST, f->post_multipart);
-	} else {
-		SETOPT(CURLOPT_POSTFIELDS, NULL);
-		SETOPT(CURLOPT_HTTPPOST, NULL);
-		SETOPT(CURLOPT_HTTPGET, 1L);
+	code = fetch_curl_set_postdata(f);
+	if (code != CURLE_OK) {
+		return code;
 	}
 
 	f->cookie_string = urldb_get_cookie(f->url, true);
@@ -949,6 +1231,12 @@ static CURLcode fetch_curl_set_options(struct curl_fetch_info *f)
 		SETOPT(CURLOPT_PROXY, NULL);
 	}
 
+
+	if (curl_with_openssl) {
+		SETOPT(CURLOPT_SSL_CIPHER_LIST,
+			f->downgrade_tls ? CIPHER_LIST_LEGACY : CIPHER_LIST);
+	}
+
 	/* Force-enable SSL session ID caching, as some distros are odd. */
 	SETOPT(CURLOPT_SSL_SESSIONID_CACHE, 1);
 
@@ -1162,15 +1450,13 @@ static void fetch_curl_free(void *vf)
 	if (f->headers) {
 		curl_slist_free_all(f->headers);
 	}
-	free(f->post_urlenc);
-	if (f->post_multipart) {
-		curl_formfree(f->post_multipart);
-	}
+	fetch_curl_free_postdata(f->postdata);
+	NSCURL_POSTDATA_FREE(f->curl_postdata);
 
 	/* free certificate data */
 	for (i = 0; i < MAX_CERT_DEPTH; i++) {
 		if (f->cert_data[i].cert != NULL) {
-			ns_X509_free(f->cert_data[i].cert);
+			X509_free(f->cert_data[i].cert);
 		}
 	}
 
@@ -1200,7 +1486,7 @@ static bool fetch_curl_process_headers(struct curl_fetch_info *f)
 	http_code = f->http_code;
 	NSLOG(netsurf, INFO, "HTTP status code %li", http_code);
 
-	if (http_code == 304 && !f->post_urlenc && !f->post_multipart) {
+	if ((http_code == 304) && (f->postdata->type==FETCH_POSTDATA_NONE)) {
 		/* Not Modified && GET request */
 		msg.type = FETCH_NOTMODIFIED;
 		fetch_send_callback(&msg, f->fetch_handle);
@@ -1436,10 +1722,10 @@ static void fetch_curl_poll(lwc_string *scheme_ignored)
  */
 static int
 fetch_curl_progress(void *clientp,
-		    double dltotal,
-		    double dlnow,
-		    double ultotal,
-		    double ulnow)
+		    NSCURL_PROGRESS_T dltotal,
+		    NSCURL_PROGRESS_T dlnow,
+		    NSCURL_PROGRESS_T ultotal,
+		    NSCURL_PROGRESS_T ulnow)
 {
 	static char fetch_progress_buffer[256]; /**< Progress buffer for cURL */
 	struct curl_fetch_info *f = (struct curl_fetch_info *) clientp;
@@ -1506,6 +1792,24 @@ fetch_curl_debug(CURL *handle,
 }
 
 
+static curl_socket_t fetch_curl_socket_open(void *clientp,
+		curlsocktype purpose, struct curl_sockaddr *address)
+{
+	(void) clientp;
+	(void) purpose;
+
+	return (curl_socket_t) guit->fetch->socket_open(
+			address->family, address->socktype,
+			address->protocol);
+}
+
+static int fetch_curl_socket_close(void *clientp, curl_socket_t item)
+{
+	(void) clientp;
+
+	return guit->fetch->socket_close((int) item);
+}
+
 /**
  * Callback function for cURL.
  */
@@ -1712,8 +2016,10 @@ nserror fetch_curl_register(void)
 #undef SETOPT
 #define SETOPT(option, value) \
 	mcode = curl_multi_setopt(fetch_curl_multi, option, value);	\
-	if (mcode != CURLM_OK)						\
-		goto curl_multi_setopt_failed;
+	if (mcode != CURLM_OK) {					\
+		NSLOG(netsurf, ERROR, "attempting curl_multi_setopt(%s, ...)", #option); \
+		goto curl_multi_setopt_failed;				\
+	}
 
 		SETOPT(CURLMOPT_MAXCONNECTS, maxconnects);
 		SETOPT(CURLMOPT_MAX_TOTAL_CONNECTIONS, maxconnects);
@@ -1733,8 +2039,10 @@ nserror fetch_curl_register(void)
 #undef SETOPT
 #define SETOPT(option, value) \
 	code = curl_easy_setopt(fetch_blank_curl, option, value);	\
-	if (code != CURLE_OK)						\
-		goto curl_easy_setopt_failed;
+	if (code != CURLE_OK) {						\
+		NSLOG(netsurf, ERROR, "attempting curl_easy_setopt(%s, ...)", #option); \
+		goto curl_easy_setopt_failed;				\
+	}
 
 	SETOPT(CURLOPT_ERRORBUFFER, fetch_error_buffer);
 	SETOPT(CURLOPT_DEBUGFUNCTION, fetch_curl_debug);
@@ -1749,7 +2057,7 @@ nserror fetch_curl_register(void)
 
 	SETOPT(CURLOPT_WRITEFUNCTION, fetch_curl_data);
 	SETOPT(CURLOPT_HEADERFUNCTION, fetch_curl_header);
-	SETOPT(CURLOPT_PROGRESSFUNCTION, fetch_curl_progress);
+	SETOPT(NSCURLOPT_PROGRESS_FUNCTION, fetch_curl_progress);
 	SETOPT(CURLOPT_NOPROGRESS, 0);
 	SETOPT(CURLOPT_USERAGENT, user_agent_string());
 	SETOPT(CURLOPT_ENCODING, "gzip");
@@ -1757,6 +2065,8 @@ nserror fetch_curl_register(void)
 	SETOPT(CURLOPT_LOW_SPEED_TIME, 180L);
 	SETOPT(CURLOPT_NOSIGNAL, 1L);
 	SETOPT(CURLOPT_CONNECTTIMEOUT, nsoption_uint(curl_fetch_timeout));
+	SETOPT(CURLOPT_OPENSOCKETFUNCTION, fetch_curl_socket_open);
+	SETOPT(CURLOPT_CLOSESOCKETFUNCTION, fetch_curl_socket_close);
 
 	if (nsoption_charp(ca_bundle) &&
 	    strcmp(nsoption_charp(ca_bundle), "")) {
@@ -1786,6 +2096,14 @@ nserror fetch_curl_register(void)
 		/* only set the cipher list with openssl otherwise the
 		 *  fetch fails with "Unknown cipher in list"
 		 */
+#if LIBCURL_VERSION_NUM >= 0x073d00
+		/* Need libcurl 7.61.0 or later built against OpenSSL with
+		 * TLS1.3 support */
+		code = curl_easy_setopt(fetch_blank_curl,
+				CURLOPT_TLS13_CIPHERS, CIPHER_SUITES);
+		if (code != CURLE_OK && code != CURLE_NOT_BUILT_IN)
+			goto curl_easy_setopt_failed;
+#endif
 		SETOPT(CURLOPT_SSL_CIPHER_LIST, CIPHER_LIST);
 	}