/***************************************************************************

 *                                  _   _ ____  _

 *  Project                     ___| | | |  _ \| |

 *                             / __| | | | |_) | |

 *                            | (__| |_| |  _ <| |___

 *                             \___|\___/|_| \_\_____|

 *

 * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.

 *

 * This software is licensed as described in the file COPYING, which

 * you should have received as part of this distribution. The terms

 * are also available at https://curl.se/docs/copyright.html.

 *

 * You may opt to use, copy, modify, merge, publish, distribute and/or sell

 * copies of the Software, and permit persons to whom the Software is

 * furnished to do so, under the terms of the COPYING file.

 *

 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY

 * KIND, either express or implied.

 *

 * SPDX-License-Identifier: curl

 *

 ***************************************************************************/

#include "curl_setup.h"

#ifdef HAVE_NETINET_IN_H

#include <netinet/in.h>

#endif

#ifdef HAVE_NETDB_H

#include <netdb.h>

#endif

#ifdef HAVE_ARPA_INET_H

#include <arpa/inet.h>

#endif

#ifdef HAVE_NET_IF_H

#include <net/if.h>

#endif

#ifdef HAVE_IPHLPAPI_H

#include <Iphlpapi.h>

#endif

#ifdef HAVE_SYS_IOCTL_H

#include <sys/ioctl.h>

#endif

#ifdef HAVE_SYS_PARAM_H

#include <sys/param.h>

#endif

#ifdef __VMS

#include <in.h>

#include <inet.h>

#endif

#ifdef HAVE_SYS_UN_H

#include <sys/un.h>

#endif

#ifndef HAVE_SOCKET

#error "We cannot compile without socket() support"

#endif

#if defined(HAVE_IF_NAMETOINDEX) && defined(USE_WINSOCK)

#if defined(__MINGW32__) && (__MINGW64_VERSION_MAJOR <= 5)

#include <wincrypt.h>  /* workaround for old mingw-w64 missing to include it */

#endif

#include <iphlpapi.h>

#endif

#include "urldata.h"

#include "mime.h"

#include "bufref.h"

#include "vtls/vtls.h"

#include "vssh/vssh.h"

#include "transfer.h"

#include "curl_addrinfo.h"

#include "curl_trc.h"

#include "progress.h"

#include "cookie.h"

#include "strcase.h"

#include "escape.h"

#include "curl_share.h"

#include "http_digest.h"

#include "multiif.h"

#include "getinfo.h"

#include "pop3.h"

#include "urlapi-int.h"

#include "hsts.h"

#include "proxy.h"

#include "cfilters.h"

#include "idn.h"

#include "http_proxy.h"

#include "conncache.h"

#include "multihandle.h"

#include "curlx/strdup.h"

#include "setopt.h"

#include "altsvc.h"

#include "curlx/dynbuf.h"

#include "headers.h"

#include "curlx/strerr.h"

#include "curlx/strparse.h"

#include "peer.h"

/* Now for the protocols */

#include "ftp.h"

#include "dict.h"

#include "telnet.h"

#include "tftp.h"

#include "http.h"

#include "vauth/vauth.h"

#include "file.h"

#include "curl_ldap.h"

#include "vssh/ssh.h"

#include "imap.h"

#include "url.h"

#include "connect.h"

#include "gopher.h"

#include "mqtt.h"

#include "rtsp.h"

#include "smtp.h"

#include "ws.h"

/* Some parts of the code (e.g. chunked encoding) assume this buffer has more

 * than a few bytes to play with. Do not let it become too small or bad things

 * will happen.

 */

#if READBUFFER_SIZE < READBUFFER_MIN

# error READBUFFER_SIZE is too small

#endif

/*

 * get_protocol_family()

 *

 * This is used to return the protocol family for a given protocol.

 *

 * Parameters:

 *

 * 's'  [in]  - struct Curl_scheme pointer.

 *

 * Returns the family as a single bit protocol identifier.

 */

static curl_prot_t get_protocol_family(const struct Curl_scheme *s)

{

  DEBUGASSERT(s);

  DEBUGASSERT(s->family);

  return s->family;

}

void Curl_freeset(struct Curl_easy *data)

{

  /* Free all dynamic strings stored in the data->set substructure. */

  enum dupblob j;

  CURL_EASY_STR_CLEAR0(data, STRING_PASSWORD);

  CURL_EASY_STR_CLEAR0(data, STRING_KEY_PASSWD);

  CURL_EASY_STR_CLEAR0(data, STRING_BEARER);

#ifndef CURL_DISABLE_PROXY

  CURL_EASY_STR_CLEAR0(data, STRING_PROXYPASSWORD);

  CURL_EASY_STR_CLEAR0(data, STRING_KEY_PASSWD_PROXY);

#endif

  Curl_u8_strset_clear(&data->set.strings);

  curlx_safefree(data->set.str_copypostfields);

  for(j = (enum dupblob)0; j < BLOB_LAST; j++) {

    curlx_safefree(data->set.blobs[j]);

  }

  Curl_bufref_free(&data->state.referer);

  Curl_bufref_free(&data->state.url);

#if !defined(CURL_DISABLE_MIME) || !defined(CURL_DISABLE_FORM_API)

  Curl_mime_cleanpart(data->set.mimepostp);

  curlx_safefree(data->set.mimepostp);

#endif

#ifndef CURL_DISABLE_COOKIES

  curl_slist_free_all(data->state.cookielist);

  data->state.cookielist = NULL;

#endif

}

/* free the URL pieces */

static void up_free(struct Curl_easy *data)

{

  struct urlpieces *up = &data->state.up;

  curlx_safefree(up->options);

  curlx_safefree(up->path);

  curlx_safefree(up->query);

  curl_url_cleanup(data->state.uh);

  data->state.uh = NULL;

}

/*

 * This is the internal function curl_easy_cleanup() calls. This should

 * cleanup and free all resources associated with this Curl_easy.

 *

 * We ignore SIGPIPE when this is called from curl_easy_cleanup.

 */

CURLcode Curl_close(struct Curl_easy **datap)

{

  struct Curl_easy *data;

  if(!datap || !*datap)

    return CURLE_OK;

  data = *datap;

  *datap = NULL;

  if(!data->state.internal && data->multi) {

    /* This handle is still part of a multi handle, take care of this first

       and detach this handle from there.

       This detaches the connection. */

    Curl_multi_remove_handle(data->multi, data);

  }

  else {

    /* Detach connection if any is left. This should not be normal, but can be

       the case for example with CONNECT_ONLY + recv/send (test 556) */

    Curl_detach_connection(data);

    if(!data->state.internal && data->multi_easy) {

      /* when curl_easy_perform() is used, it creates its own multi handle to

         use and this is the one */

      curl_multi_cleanup(data->multi_easy);

      data->multi_easy = NULL;

    }

  }

  DEBUGASSERT(!data->conn || data->state.internal);

  Curl_expire_clear_all(data); /* shut off any timers left */

  if(data->state.rangestringalloc)

    curlx_free(data->state.range);

  /* release any resolve information this transfer kept */

  Curl_resolv_destroy_all(data);

  data->set.verbose = FALSE; /* no more calls to DEBUGFUNCTION */

  data->magic = 0; /* force a clear AFTER the possibly enforced removal from

                    * the multi handle and async dns shutdown. The multi

                    * handle might check the magic and so might any

                    * DEBUGFUNCTION invoked for tracing */

  /* freed here in case DONE was not called */

  Curl_req_free(&data->req, data);

  /* Close down all open SSL info and sessions */

  Curl_ssl_close_all(data);

  Curl_peer_unlink(&data->state.origin);

  Curl_peer_unlink(&data->state.initial_origin);

  Curl_ssl_free_certinfo(data);

  Curl_bufref_free(&data->state.referer);

  up_free(data);

  curlx_dyn_free(&data->state.headerb);

  Curl_flush_cookies(data, TRUE);

#ifndef CURL_DISABLE_ALTSVC

  Curl_altsvc_save(data, data->asi, CURL_EASY_STR(data, STRING_ALTSVC));

  Curl_altsvc_cleanup(&data->asi);

#endif

#ifndef CURL_DISABLE_HSTS

  Curl_hsts_save(data, data->hsts, CURL_EASY_STR(data, STRING_HSTS));

  if(!data->share || !data->share->hsts)

    Curl_hsts_cleanup(&data->hsts);

  curl_slist_free_all(data->state.hstslist); /* clean up list */

#endif

#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_DIGEST_AUTH)

  Curl_http_auth_cleanup_digest(data);

#endif

  curlx_safefree(data->state.most_recent_ftp_entrypath);

  curlx_safefree(data->info.contenttype);

  curlx_safefree(data->info.wouldredirect);

  /* No longer a dirty share, if it exists */

  if(Curl_share_easy_unlink(data))

    DEBUGASSERT(0);

  Curl_hash_destroy(&data->meta_hash);

  Curl_creds_unlink(&data->state.creds);

#ifndef CURL_DISABLE_HTTP

  curlx_safefree(data->state.rangeline);

  curlx_safefree(data->state.http_host);

#endif

#ifndef CURL_DISABLE_COOKIES

  curlx_safefree(data->req.cookiehost);

#endif

#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_FORM_API)

  Curl_mime_cleanpart(data->state.formp);

  curlx_safefree(data->state.formp);

#endif

  /* destruct wildcard structures if it is needed */

  Curl_wildcard_dtor(&data->wildcard);

  Curl_freeset(data);

  Curl_headers_cleanup(data);

  Curl_netrc_cleanup(&data->state.netrc);

#ifndef CURL_DISABLE_DIGEST_AUTH

  curlx_free(data->state.envproxy);

#endif

  Curl_ssl_config_cleanup(&data->set.ssl.primary);

#ifndef CURL_DISABLE_PROXY

  Curl_ssl_config_cleanup(&data->set.proxy_ssl.primary);

#endif

  curlx_memzero(data, sizeof(*data));

  curlx_free(data);

  return CURLE_OK;

}

/*

 * Initialize the UserDefined fields within a Curl_easy.

 * This may be safely called on a new or existing Curl_easy.

 */

void Curl_init_userdefined(struct Curl_easy *data)

{

  struct UserDefined *set = &data->set;

  set->out = stdout;  /* default output to stdout */

  set->in_set = stdin;  /* default input from stdin */

  set->err = stderr;  /* default stderr to stderr */

  Curl_u8_strset_init(&data->set.strings);

#if defined(__clang__) && __clang_major__ >= 16

#pragma clang diagnostic push

#pragma clang diagnostic ignored "-Wcast-function-type-strict"

#endif

  /* use fwrite as default function to store output */

  set->fwrite_func = (curl_write_callback)fwrite;

  /* use fread as default function to read input */

  set->fread_func_set = (curl_read_callback)fread;

#if defined(__clang__) && __clang_major__ >= 16

#pragma clang diagnostic pop

#endif

  set->is_fread_set = 0;

  set->seek_client = ZERO_NULL;

  set->filesize = -1;        /* we do not know the size */

  set->postfieldsize = -1;   /* unknown size */

  set->maxredirs = 30;       /* sensible default */

  set->method = HTTPREQ_GET; /* Default HTTP request */

#ifndef CURL_DISABLE_RTSP

  set->rtspreq = RTSPREQ_OPTIONS; /* Default RTSP request */

#endif

#ifndef CURL_DISABLE_FTP

  set->ftp_use_epsv = TRUE;   /* FTP defaults to EPSV operations */

  set->ftp_use_eprt = TRUE;   /* FTP defaults to EPRT operations */

  set->ftp_use_pret = FALSE;  /* mainly useful for drftpd servers */

  set->ftp_filemethod = FTPFILE_MULTICWD;

  set->ftp_skip_ip = TRUE;    /* skip PASV IP by default */

#endif

  set->dns_cache_timeout_ms = 60000; /* Timeout every 60 seconds by default */

  /* Timeout every 24 hours by default */

  set->general_ssl.ca_cache_timeout = 24 * 60 * 60;

  set->httpauth = CURLAUTH_BASIC;  /* defaults to basic */

  Curl_ssl_config_init(&data->set.ssl.primary);

#ifndef CURL_DISABLE_PROXY

  Curl_ssl_config_init(&data->set.proxy_ssl.primary);

  set->proxyport = 0;

  set->proxytype = CURLPROXY_HTTP; /* defaults to HTTP proxy */

  set->proxyauth = CURLAUTH_BASIC; /* defaults to basic */

  /* SOCKS5 proxy auth defaults to username/password + GSS-API */

  set->socks5auth = CURLAUTH_BASIC | CURLAUTH_GSSAPI;

#endif

#ifndef CURL_DISABLE_DOH

  set->doh_verifyhost = TRUE;

  set->doh_verifypeer = TRUE;

#endif

#ifdef USE_SSH

  /* defaults to any auth type */

  set->ssh_auth_types = CURLSSH_AUTH_DEFAULT;

  set->new_directory_perms = 0755; /* Default permissions */

#endif

  set->new_file_perms = 0644;    /* Default permissions */

  set->allowed_protocols = (curl_prot_t)CURLPROTO_64ALL;

  set->redir_protocols = CURLPROTO_REDIR;

#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)

  /*

   * disallow unprotected protection negotiation NEC reference implementation

   * seem not to follow rfc1961 section 4.3/4.4

   */

  set->socks5_gssapi_nec = FALSE;

#endif

  /* set default minimum TLS version */

#ifdef USE_SSL

  Curl_setopt_SSLVERSION(data, CURLOPT_SSLVERSION, CURL_SSLVERSION_DEFAULT);

#ifndef CURL_DISABLE_PROXY

  Curl_setopt_SSLVERSION(data, CURLOPT_PROXY_SSLVERSION,

                         CURL_SSLVERSION_DEFAULT);

#endif

#endif

#ifndef CURL_DISABLE_FTP

  set->wildcard_enabled = FALSE;

  set->chunk_bgn = ZERO_NULL;

  set->chunk_end = ZERO_NULL;

  set->fnmatch = ZERO_NULL;

#endif

  set->tcp_keepalive = FALSE;

  set->tcp_keepintvl = 60;

  set->tcp_keepidle = 60;

  set->tcp_keepcnt = 9;

  set->tcp_fastopen = FALSE;

  set->tcp_nodelay = TRUE;

  set->ssl_enable_alpn = TRUE;

  set->expect_100_timeout = 1000L; /* Wait for a second by default. */

  set->sep_headers = TRUE; /* separated header lists by default */

  set->buffer_size = READBUFFER_SIZE;

  set->upload_buffer_size = UPLOADBUFFER_DEFAULT;

  set->upload_flags = CURLULFLAG_SEEN;

  set->happy_eyeballs_timeout = CURL_HET_DEFAULT;

  set->upkeep_interval_ms = CURL_UPKEEP_INTERVAL_DEFAULT;

  set->maxconnects = DEFAULT_CONNCACHE_SIZE; /* for easy handles */

  set->conn_max_idle_ms = 118 * 1000;

  set->conn_max_age_ms = 24 * 3600 * 1000;

  set->http09_allowed = FALSE;

  set->httpwant = CURL_HTTP_VERSION_NONE;

#if defined(USE_HTTP2) || defined(USE_HTTP3)

  set->weight = 0;

#endif

  set->quick_exit = 0L;

#ifndef CURL_DISABLE_WEBSOCKETS

  set->ws_raw_mode = FALSE;

  set->ws_no_auto_pong = FALSE;

#endif

}

/* easy->meta_hash destructor. Should never be called as elements

 * MUST be added with their own destructor */

static void easy_meta_freeentry(void *p)

{

  (void)p;

  /* Always FALSE. Cannot use a 0 assert here since compilers

   * are not in agreement if they then want a NORETURN attribute or

   * not. *sigh* */

  DEBUGASSERT(!p);

}

/**

 * Curl_open()

 *

 * @param curl is a pointer to a Curl_easy pointer that gets set by this

 * function.

 * @return CURLcode

 */

CURLcode Curl_open(struct Curl_easy **curl)

{

  struct Curl_easy *data;

  /* simple start-up: alloc the struct, init it with zeroes and return */

  data = curlx_calloc(1, sizeof(struct Curl_easy));

  if(!data) {

    /* this is a serious error */

    DEBUGF(curl_mfprintf(stderr, "Error: calloc of Curl_easy failed\n"));

    return CURLE_OUT_OF_MEMORY;

  }

  data->magic = CURLEASY_MAGIC_NUMBER;

  /* most recent connection is not yet defined */

  data->state.lastconnect_id = -1;

  /* and not assigned an id yet */

  data->id = -1;

  data->mid = UINT32_MAX;

  data->master_mid = UINT32_MAX;

  data->progress.hide = TRUE;

  Curl_hash_init(&data->meta_hash, 23,

                 Curl_hash_str, curlx_str_key_compare, easy_meta_freeentry);

  DEBUGASSERT(STRING_LAST <= UINT8_MAX);

  Curl_u8_strset_init(&data->set.strings);

  curlx_dyn_init(&data->state.headerb, CURL_MAX_HTTP_HEADER);

  Curl_bufref_init(&data->state.url);

  Curl_bufref_init(&data->state.referer);

  Curl_req_init(&data->req);

  Curl_initinfo(data);

#ifndef CURL_DISABLE_HTTP

  Curl_llist_init(&data->state.httphdrs, NULL);

#endif

  Curl_netrc_init(&data->state.netrc);

  Curl_init_userdefined(data);

  *curl = data;

  return CURLE_OK;

}

void Curl_conn_free(struct Curl_easy *data, struct connectdata *conn)

{

  int8_t i;

  DEBUGASSERT(conn);

  if(conn->scheme && conn->scheme->run->disconnect &&

     !conn->bits.shutdown_handler)

    conn->scheme->run->disconnect(data, conn, TRUE);

  for(i = 0; i < (int8_t)CURL_ARRAYSIZE(conn->cfilter); ++i) {

    Curl_conn_cf_discard_all(data, conn, i);

  }

#ifndef CURL_DISABLE_PROXY

  Curl_peer_unlink(&conn->http_proxy.peer);

  Curl_peer_unlink(&conn->socks_proxy.peer);

  Curl_creds_unlink(&conn->http_proxy.creds);

  Curl_creds_unlink(&conn->socks_proxy.creds);

#endif

  Curl_creds_unlink(&conn->creds);

  Curl_peer_unlink(&conn->creds_origin);

  curlx_safefree(conn->options);

  curlx_safefree(conn->localdev);

  Curl_ssl_conn_config_cleanup(conn);

  curlx_safefree(conn->destination);

  Curl_hash_destroy(&conn->meta_hash);

  Curl_peer_unlink(&conn->origin);

  Curl_peer_unlink(&conn->via_peer);

  Curl_peer_unlink(&conn->origin2);

  Curl_peer_unlink(&conn->via_peer2);

  curlx_free(conn); /* free all the connection oriented data */

}

/*

 * xfer_may_multiplex()

 *

 * Return a TRUE, iff the transfer can be done over an (appropriate)

 * multiplexed connection.

 */

static bool xfer_may_multiplex(const struct Curl_easy *data,

                               const struct connectdata *conn)

{

#ifndef CURL_DISABLE_HTTP

  /* If an HTTP protocol and multiplexing is enabled */

  if((conn->scheme->protocol & PROTO_FAMILY_HTTP) &&

     (!conn->bits.protoconnstart || !conn->bits.close)) {

    if(Curl_multiplex_wanted(data->multi) &&

       (data->state.http_neg.allowed & (CURL_HTTP_V2x | CURL_HTTP_V3x)))

      /* allows HTTP/2 or newer */

      return TRUE;

  }

#else

  (void)data;

  (void)conn;

#endif

  return FALSE;

}

#ifndef CURL_DISABLE_PROXY

static bool proxy_info_matches(const struct proxy_info *data,

                               const struct proxy_info *needle)

{

  if((data->proxytype == needle->proxytype) &&

     Curl_peer_same_destination(data->peer, needle->peer) &&

     Curl_creds_same(data->creds, needle->creds)) {

    return TRUE;

  }

  return FALSE;

}

#endif

#ifdef USE_SSH

static bool ssh_config_matches(struct connectdata *one,

                               struct connectdata *two)

{

  struct ssh_conn *sshc1, *sshc2;

  sshc1 = Curl_conn_meta_get(one, CURL_META_SSH_CONN);

  sshc2 = Curl_conn_meta_get(two, CURL_META_SSH_CONN);

  return sshc1 && sshc2 && Curl_safecmp(sshc1->priv_key, sshc2->priv_key) &&

         Curl_safecmp(sshc1->pub_key, sshc2->pub_key);

}

#endif

struct url_conn_match {

  struct connectdata *found;

  struct Curl_easy *data;

  struct connectdata *needle;

  struct curltime now;

  BIT(may_multiplex);

  BIT(want_ntlm_http);

  BIT(want_proxy_ntlm_http);

  BIT(want_nego_http);

  BIT(want_proxy_nego_http);

  BIT(may_tls); /* May upgrade clear-text connection to TLS, can only reuse

                 * connections that have matching TLS configuration.

                 * Always TRUE if `req_tls` is TRUE. */

  BIT(require_tls); /* Requires TLS use from a clear-text start, can only

                 * reuse connections that have TLS. */

  BIT(wait_pipe);

  BIT(force_reuse);

  BIT(seen_pending_conn);

  BIT(seen_single_use_conn);

  BIT(seen_multiplex_conn);

};

static bool url_match_connect_config(struct connectdata *conn,

                                     struct url_conn_match *m)

{

  /* connect-only or to-be-closed connections will not be reused */

  if(conn->bits.connect_only || conn->bits.close || conn->bits.no_reuse)

    return FALSE;

  /* ip_version must match */

  if(m->data->set.ipver != CURL_IPRESOLVE_WHATEVER &&

     m->data->set.ipver != conn->ip_version)

    return FALSE;

  if(m->needle->localdev || m->needle->localport) {

    /* If we are bound to a specific local end (IP+port), we must not reuse a

       random other one, although if we did not ask for a particular one we

       can reuse one that was bound.

       This comparison is a bit rough and too strict. Since the input

       parameters can be specified in numerous ways and still end up the same

       it would take a lot of processing to make it really accurate. Instead,

       this matching will assume that reuses of bound connections will most

       likely also reuse the exact same binding parameters and missing out a

       few edge cases should not hurt anyone much. */

    if((conn->localport != m->needle->localport) ||

       (conn->localportrange != m->needle->localportrange) ||

       (m->needle->localdev &&

        (!conn->localdev || strcmp(conn->localdev, m->needle->localdev))))

      return FALSE;

  }

  if(!m->needle->via_peer != !conn->via_peer)

    /* do not mix connections that use the "connect to host" feature and

     * connections that do not use this feature */

    return FALSE;

  return TRUE;

}

static bool url_match_fully_connected(struct connectdata *conn,

                                      struct url_conn_match *m)

{

  if(!Curl_conn_is_connected(conn, FIRSTSOCKET) ||

     conn->bits.upgrade_in_progress) {

    /* Not yet connected, or a protocol upgrade is in progress. The later

     * happens for HTTP/2 Upgrade: requests that need a response. */

    if(m->may_multiplex) {

      m->seen_pending_conn = TRUE;

      /* Do not pick a connection that has not connected yet */

      infof(m->data, "Connection #%" FMT_OFF_T

            " is not open enough, cannot reuse", conn->connection_id);

    }

    /* Do not pick a connection that has not connected yet */

    return FALSE;

  }

  return TRUE;

}

static bool url_match_multi(struct connectdata *conn,

                            struct url_conn_match *m)

{

  if(CONN_INUSE(conn)) {

    DEBUGASSERT(conn->attached_multi);

    if(conn->attached_multi != m->data->multi)

      return FALSE;

  }

  return TRUE;

}

static bool url_match_multiplex_needs(struct connectdata *conn,

                                      struct url_conn_match *m)

{

  if(CONN_INUSE(conn)) {

    if(!conn->bits.multiplex) {

      /* conn busy and conn cannot take more transfers */

      m->seen_single_use_conn = TRUE;

      return FALSE;

    }

    m->seen_multiplex_conn = TRUE;

    if(!m->may_multiplex || !url_match_multi(conn, m))

      /* conn busy and transfer cannot be multiplexed */

      return FALSE;

  }

  return TRUE;

}

static bool url_match_multiplex_limits(struct connectdata *conn,

                                       struct url_conn_match *m)

{

  if(CONN_INUSE(conn) && m->may_multiplex) {

    DEBUGASSERT(conn->bits.multiplex);

    /* If multiplexed, make sure we do not go over concurrency limit */

    if(conn->attached_xfers >=

            Curl_multi_max_concurrent_streams(m->data->multi)) {

      infof(m->data, "client side MAX_CONCURRENT_STREAMS reached"

            ", skip (%u)", conn->attached_xfers);

      return FALSE;

    }

    if(conn->attached_xfers >=

       Curl_conn_get_max_concurrent(m->data, conn, FIRSTSOCKET)) {

      infof(m->data, "MAX_CONCURRENT_STREAMS reached, skip (%u)",

            conn->attached_xfers);

      return FALSE;

    }

    /* When not multiplexed, we have a match here! */

    infof(m->data, "Multiplexed connection found");

  }

  return TRUE;

}

static bool url_match_ssl_use(struct connectdata *conn,

                              struct url_conn_match *m)

{

  if(m->needle->scheme->flags & PROTOPT_SSL) {

    /* We are looking for SSL, if `conn` does not do it, not a match. */

    if(!Curl_conn_is_ssl(conn, FIRSTSOCKET))

      return FALSE;

  }

  else if(Curl_conn_is_ssl(conn, FIRSTSOCKET)) {

    /* If the protocol does not allow reuse of SSL connections OR

       is of another protocol family, not a match. */

    if(!(m->needle->scheme->flags & PROTOPT_SSL_REUSE) ||

       (get_protocol_family(conn->scheme) != m->needle->scheme->protocol))

      return FALSE;

    /* We may reuse this as an auto-TLS upgrade, but only if the SSL

     * config parameters match. */

    if(!Curl_ssl_conn_config_match(m->data, conn, FALSE))

      return FALSE;

  }

  else if(m->require_tls)

    /* a clear-text STARTTLS protocol with required TLS */

    return FALSE;

  return TRUE;

}

#ifndef CURL_DISABLE_PROXY

static bool url_match_proxy_use(struct connectdata *conn,

                                struct url_conn_match *m)

{

  if(m->needle->bits.origin_is_proxy != conn->bits.origin_is_proxy)

    return FALSE;

  if(!proxy_info_matches(&m->needle->socks_proxy, &conn->socks_proxy))

    return FALSE;

  if(!proxy_info_matches(&m->needle->http_proxy, &conn->http_proxy))

    return FALSE;

  if(CURL_PROXY_IS_HTTPS(m->needle->http_proxy.proxytype)) {

    /* https proxies come in different types, http/1.1, h2, ... */

    /* match SSL config to proxy */

    if(!Curl_ssl_conn_config_match(m->data, conn, TRUE)) {

      DEBUGF(infof(m->data,

                   "Connection #%" FMT_OFF_T

                   " has different SSL proxy parameters, cannot reuse",

                   conn->connection_id));

      return FALSE;

    }

    /* the SSL config to the server, which may apply here is checked

     * further below */

  }

  return TRUE;

}

#else

#define url_match_proxy_use(c, m) ((void)(c), (void)(m), TRUE)

#endif

#ifndef CURL_DISABLE_HTTP

static bool url_match_http_multiplex(struct connectdata *conn,

                                     struct url_conn_match *m)

{

  if(m->may_multiplex &&

     (m->data->state.http_neg.allowed & (CURL_HTTP_V2x | CURL_HTTP_V3x)) &&

     (m->needle->scheme->protocol & CURLPROTO_HTTP) &&

     !conn->httpversion_seen) {

    if(m->data->set.pipewait) {

      infof(m->data, "Server upgrade does not support multiplex yet, wait");

      m->found = NULL;

      m->wait_pipe = TRUE;

      return TRUE; /* stop searching, we want to wait */

    }

    infof(m->data, "Server upgrade cannot be used");

    return FALSE;

  }

  return TRUE;

}

static bool url_match_http_version(struct connectdata *conn,

                                   struct url_conn_match *m)

{

  /* If looking for HTTP and the HTTP versions allowed do not include

   * the HTTP version of conn, continue looking. */

  if((m->needle->scheme->protocol & PROTO_FAMILY_HTTP)) {

    switch(Curl_conn_http_version(m->data, conn)) {

    case 30:

      if(!(m->data->state.http_neg.allowed & CURL_HTTP_V3x)) {

        DEBUGF(infof(m->data, "not reusing conn #%" CURL_FORMAT_CURL_OFF_T

                     ", we do not want h3", conn->connection_id));

        return FALSE;

      }

      break;

    case 20:

      if(!(m->data->state.http_neg.allowed & CURL_HTTP_V2x)) {

        DEBUGF(infof(m->data, "not reusing conn #%" CURL_FORMAT_CURL_OFF_T

                     ", we do not want h2", conn->connection_id));

        return FALSE;

      }

      break;

    default:

      if(!(m->data->state.http_neg.allowed & CURL_HTTP_V1x)) {

        DEBUGF(infof(m->data, "not reusing conn #%" CURL_FORMAT_CURL_OFF_T

                     ", we do not want h1", conn->connection_id));

        return FALSE;

      }

      break;

    }

  }

  return TRUE;

}

#else

#define url_match_http_multiplex(c, m) ((void)(c), (void)(m), TRUE)

#define url_match_http_version(c, m)   ((void)(c), (void)(m), TRUE)

#endif

static bool url_match_proto_config(struct connectdata *conn,

                                   struct url_conn_match *m)

{

  if(!url_match_http_version(conn, m))

    return FALSE;

#ifdef USE_SSH

  if(get_protocol_family(m->needle->scheme) & PROTO_FAMILY_SSH) {

    if(!ssh_config_matches(m->needle, conn))

      return FALSE;

  }

#endif

#ifndef CURL_DISABLE_FTP

  else if(get_protocol_family(m->needle->scheme) & PROTO_FAMILY_FTP) {

    if(!Curl_ftp_conns_match(m->needle, conn))

      return FALSE;

  }

#endif

  return TRUE;

}

static bool url_match_auth(struct connectdata *conn,

                           struct url_conn_match *m)

{

  if(!Curl_creds_same(m->needle->creds, conn->creds)) {

    if(m->needle->creds)

      return FALSE;

    if(!Curl_creds_same(m->data->state.creds, conn->creds))

      return FALSE;

  }

#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)

  /* GSS delegation differences do not actually affect every connection and

     auth method, but this check takes precaution before efficiency */

  if(m->needle->gssapi_delegation != conn->gssapi_delegation)

    return FALSE;

#endif

  return TRUE;

}

static bool url_match_destination(struct connectdata *conn,

                                  struct url_conn_match *m)

{

  /* Different connect-to peers never match */

  if(!Curl_peer_same_destination(m->needle->via_peer, conn->via_peer))

    return FALSE;

  if(m->needle->origin->scheme != conn->origin->scheme) {

    /* `needle` and `conn` not having the same scheme.

     * This is allowed for the same family *if* conn is using TLS.

     * - IMAP+STARTTLS works for IMAPS.

     * - IMAPS works for IMAP. */

    if(get_protocol_family(conn->origin->scheme) !=

       m->needle->scheme->protocol) {

      return FALSE;

    }

  }

  /* Scheme mismatch is acceptable, compare hostname/port */

  return Curl_peer_same_destination(m->needle->origin, conn->origin);

}

static bool url_match_ssl_config(struct connectdata *conn,

                                 struct url_conn_match *m)

{

  /* If talking/upgrading to TLS, conn needs to use the same SSL options. */

  if(((m->needle->scheme->flags & PROTOPT_SSL) || m->may_tls) &&

     !Curl_ssl_conn_config_match(m->data, conn, FALSE)) {

    DEBUGF(infof(m->data, "Connection #%" FMT_OFF_T

                 " has different SSL parameters, cannot reuse",

                 conn->connection_id));

    return FALSE;

  }

  return TRUE;

}

#if defined(USE_SPNEGO) || defined(USE_NTLM)

static bool url_allow_sspi_empty_creds(struct Curl_creds *conn_creds,

                                       struct Curl_easy *data,

                                       struct connectdata *conn)

{

#ifdef USE_WINDOWS_SSPI

  /* Empty user: SSPI on Windows can make use of an "ambient"

   * user from a "SecurityToken" associated with the current thread or

   * process. This token can be switched at any time. We are therefore

   * not able to find out reliably what token the connection really

   * used, nor what token in the next connect attempt will use.

   * To avoid TOCTOU attacks, do not reuse on empty credentials

   * UNLESS this connection is the one used by this transfer before. */

  if(!Curl_creds_has_user(conn_creds) &&