curl: upgrade to release 7.56.1

- fixes a very minor CVE: CVE-2017-1000254
- the Windows nmakefiles we were previously using have been
removed, so we use the *other* Windows nmake build system now
- /EHs override is pointless, default /EHsc should work fine
- the macros defined in ExternalProject are not needed any more
- curl-msvc-schannel.patch.1: drop, not needed with new makefiles
- curl-osx.patch.1: none of it applies, presumably fixed upstream

Change-Id: I15c71b9c82c31d286d935b57543a1b0216123b66
Reviewed-on: https://gerrit.libreoffice.org/43724
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Michael Stahl <mstahl@redhat.com>

11 files changed, 76 insertions, 381 deletions

diff --git a/RepositoryExternal.mk b/RepositoryExternal.mk
index b1642dea4ca6..f1f39de76f3b 100644
--- a/RepositoryExternal.mk
+++ b/RepositoryExternal.mk
@@ -2711,7 +2711,7 @@ $(call gb_LinkTarget_set_include,$(1),\
 
 ifeq ($(COM),MSC)
 $(call gb_LinkTarget_add_libs,$(1),\
-	$(call gb_UnpackedTarball_get_dir,curl)/lib/$(if $(MSVC_USE_DEBUG_RUNTIME),debug-dll,release-dll)/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),d)_imp.lib \
+	$(call gb_UnpackedTarball_get_dir,curl)/builds/libcurl-vc12-$(if $(filter X86_64,$(CPUNAME)),x64,x86)-$(if $(MSVC_USE_DEBUG_RUNTIME),debug,release)-dll-ipv6-sspi-winssl/lib/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),_debug).lib \
 )
 else
 $(call gb_LinkTarget_add_libs,$(1),\
diff --git a/download.lst b/download.lst
index 25f8060c392a..20d1cb4be7a7 100644
--- a/download.lst
+++ b/download.lst
@@ -30,8 +30,8 @@ export CPPUNIT_SHA256SUM := 3d569869d27b48860210c758c4f313082103a5e58219a7669b52
 export CPPUNIT_TARBALL := cppunit-1.14.0.tar.gz
 export CT2N_SHA256SUM := 71b238efd2734be9800af07566daea8d6685aeed28db5eb5fa0e6453f4d85de3
 export CT2N_TARBALL := 1f467e5bb703f12cbbb09d5cf67ecf4a-converttexttonumber-1-5-0.oxt
-export CURL_SHA256SUM := a8984e8b20880b621f61a62d95ff3c0763a3152093a9f9ce4287cfd614add6ae
-export CURL_TARBALL := curl-7.52.1.tar.gz
+export CURL_SHA256SUM := 961a25531d72a843dfcce87b290e7a882f2d376f3b88de11df009710019c5b16
+export CURL_TARBALL := curl-7.56.1.tar.gz
 export EBOOK_SHA256SUM := b710a57c633205b933015474d0ac0862253d1c52114d535dd09b20939a0d1850
 export EBOOK_TARBALL := libe-book-0.1.2.tar.bz2
 export EPOXY_SHA256SUM := 1d8668b0a259c709899e1c4bab62d756d9002d546ce4f59c9665e2fc5f001a64
diff --git a/external/curl/ExternalPackage_curl.mk b/external/curl/ExternalPackage_curl.mk
index 18907f4e5a54..56c418b6ef0c 100644
--- a/external/curl/ExternalPackage_curl.mk
+++ b/external/curl/ExternalPackage_curl.mk
@@ -14,13 +14,13 @@ $(eval $(call gb_ExternalPackage_use_external_project,curl,curl))
 ifneq ($(DISABLE_DYNLOADING),TRUE)
 
 ifeq ($(COM),MSC)
-$(eval $(call gb_ExternalPackage_add_file,curl,$(LIBO_LIB_FOLDER)/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),d).dll,lib/$(if $(MSVC_USE_DEBUG_RUNTIME),debug-dll,release-dll)/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),d).dll))
+$(eval $(call gb_ExternalPackage_add_file,curl,$(LIBO_LIB_FOLDER)/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),_debug).dll,builds/libcurl-vc12-$(if $(filter X86_64,$(CPUNAME)),x64,x86)-$(if $(MSVC_USE_DEBUG_RUNTIME),debug,release)-dll-ipv6-sspi-winssl/bin/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),_debug).dll))
 else ifeq ($(OS),MACOSX)
 $(eval $(call gb_ExternalPackage_add_file,curl,$(LIBO_LIB_FOLDER)/libcurl.4.dylib,lib/.libs/libcurl.4.dylib))
 else ifeq ($(OS),AIX)
 $(eval $(call gb_ExternalPackage_add_file,curl,$(LIBO_LIB_FOLDER)/libcurl.so,lib/.libs/libcurl.so.4))
 else
-$(eval $(call gb_ExternalPackage_add_file,curl,$(LIBO_LIB_FOLDER)/libcurl.so.4,lib/.libs/libcurl.so.4.4.0))
+$(eval $(call gb_ExternalPackage_add_file,curl,$(LIBO_LIB_FOLDER)/libcurl.so.4,lib/.libs/libcurl.so.4.5.0))
 endif
 
 endif # $(DISABLE_DYNLOADING)
diff --git a/external/curl/ExternalProject_curl.mk b/external/curl/ExternalProject_curl.mk
index a8a03a568246..b9ac6980d758 100644
--- a/external/curl/ExternalProject_curl.mk
+++ b/external/curl/ExternalProject_curl.mk
@@ -71,10 +71,17 @@ else ifeq ($(COM),MSC)
 
 $(call gb_ExternalProject_get_state_target,curl,build):
 	$(call gb_ExternalProject_run,build,\
-		MAKEFLAGS= LIB="$(ILIB)" nmake -f Makefile.vc12 \
-			cfg=$(if $(MSVC_USE_DEBUG_RUNTIME),debug-dll,release-dll) \
-			EXCFLAGS="/EHs /D_CRT_SECURE_NO_DEPRECATE /DUSE_WINDOWS_SSPI $(SOLARINC)" $(if $(filter X86_64,$(CPUNAME)),MACHINE=X64) \
-	,lib)
+		CC="$(shell cygpath -w $(filter-out -%,$(CC))) $(filter -%,$(CC))" \
+		MAKEFLAGS= LIB="$(ILIB)" nmake -f Makefile.vc \
+			mode=dll \
+			VC=12 \
+			$(if $(filter X86_64,$(CPUNAME)),MACHINE=x64,MACHINE=x86) \
+			GEN_PDB=$(if $(gb_SYMBOL),yes,no) \
+			DEBUG=$(if $(MSVC_USE_DEBUG_RUNTIME),yes,no) \
+			ENABLE_IPV6=yes \
+			ENABLE_SSPI=yes \
+			ENABLE_WINSSL=yes \
+	,winbuild)
 
 endif
 
diff --git a/external/curl/UnpackedTarball_curl.mk b/external/curl/UnpackedTarball_curl.mk
index 81673b775986..b65b3d5cb300 100644
--- a/external/curl/UnpackedTarball_curl.mk
+++ b/external/curl/UnpackedTarball_curl.mk
@@ -14,13 +14,12 @@ $(eval $(call gb_UnpackedTarball_set_tarball,curl,$(CURL_TARBALL),,curl))
 $(eval $(call gb_UnpackedTarball_set_patchlevel,curl,1))
 
 $(eval $(call gb_UnpackedTarball_fix_end_of_line,curl,\
-	lib/Makefile.vc12 \
+	winbuild/MakefileBuild.vc \
 ))
 
 $(eval $(call gb_UnpackedTarball_add_patches,curl,\
 	external/curl/curl-msvc.patch.1 \
 	external/curl/curl-msvc-disable-protocols.patch.1 \
-	external/curl/curl-msvc-schannel.patch.1 \
 	external/curl/curl-7.26.0_win-proxy.patch \
 	external/curl/zlib.patch.0 \
 ))
@@ -31,12 +30,4 @@ $(eval $(call gb_UnpackedTarball_add_patches,curl,\
 ))
 endif
 
-ifeq ($(OS),MACOSX)
-ifneq ($(filter 1090 101000,$(MAC_OS_X_VERSION_MIN_REQUIRED)),)
-$(eval $(call gb_UnpackedTarball_add_patches,curl,\
-	external/curl/curl-osx.patch.1 \
-))
-endif
-endif
-
 # vim: set noet sw=4 ts=4:
diff --git a/external/curl/curl-7.26.0_win-proxy.patch b/external/curl/curl-7.26.0_win-proxy.patch
index 1c478868d7d2..e51c5d017818 100644
--- a/external/curl/curl-7.26.0_win-proxy.patch
+++ b/external/curl/curl-7.26.0_win-proxy.patch
@@ -1,14 +1,14 @@
---- curl-7.26.0/lib/Makefile.vc12
-+++ misc/build/curl-7.26.0/lib/Makefile.vc12
-@@ -118,7 +118,7 @@
- WINSSLLIBS   = crypt32.lib
- ZLIBLIBSDLL  = zdll.lib
- ZLIBLIBS     = zlib.lib
--WINLIBS      = ws2_32.lib wldap32.lib advapi32.lib
-+WINLIBS      = ws2_32.lib wldap32.lib advapi32.lib winhttp.lib crypt32.lib
- CFLAGS       = $(CFLAGS) $(EXCFLAGS)
+--- curl/winbuild/MakefileBuild.vc.orig	2017-10-23 17:15:22.969492548 +0200
++++ curl/winbuild/MakefileBuild.vc	2017-10-23 17:16:38.491490679 +0200
+@@ -72,7 +72,7 @@
  
- CFGSET       = FALSE
+ CFLAGS_LIBCURL_STATIC  = /DCURL_STATICLIB
+ 
+-WIN_LIBS    = ws2_32.lib wldap32.lib advapi32.lib
++WIN_LIBS    = ws2_32.lib wldap32.lib advapi32.lib winhttp.lib
+ 
+ BASE_NAME              = libcurl
+ BASE_NAME_DEBUG        = $(BASE_NAME)_debug
 --- curl-7.26.0/lib/url.c
 +++ misc/build/curl-7.26.0/lib/url.c
 @@ -78,6 +78,10 @@
@@ -23,9 +23,9 @@
  #include "netrc.h"
  
 @@ -4586,6 +4590,21 @@
-   return FALSE;
  }
  
+ #ifndef CURL_DISABLE_HTTP
 +#ifdef _WIN32
 +static char *wstrToCstr(LPWSTR wStr)
 +{
@@ -44,20 +44,12 @@
  /****************************************************************
  * Detect what (if any) proxy to use. Remember that this selects a host
  * name and is not limited to HTTP proxies only.
-@@ -4594,6 +4613,7 @@
- static char *detect_proxy(struct connectdata *conn)
- {
-   char *proxy = NULL;
-+  char *no_proxy=NULL;
- 
- #ifndef CURL_DISABLE_HTTP
-   /* If proxy was not specified, we check for default proxy environment
-@@ -4613,7 +4633,64 @@
+@@ -4613,6 +4633,66 @@
     * For compatibility, the all-uppercase versions of these variables are
     * checked if the lowercase versions don't exist.
     */
--  char *no_proxy=NULL;
 +#ifdef _WIN32
++  char *no_proxy = NULL;
 +  WINHTTP_CURRENT_USER_IE_PROXY_CONFIG *ieProxyConfig;
 +  ieProxyConfig = (WINHTTP_CURRENT_USER_IE_PROXY_CONFIG *)
 +    malloc(sizeof(WINHTTP_CURRENT_USER_IE_PROXY_CONFIG));
@@ -114,15 +106,16 @@
 +    GlobalFree(ieProxyConfig->lpszProxy);
 +    GlobalFree(ieProxyConfig->lpszProxyBypass);
 +  }
++  free(no_proxy);
 +#else /* !WIN32 */
    char proxy_env[128];
- 
-   no_proxy=curl_getenv("no_proxy");
+   const char *protop = conn->handler->scheme;
+   char *envp = proxy_env;
 @@ -4663,6 +4739,7 @@
-     }
-   } /* if(!check_noproxy(conn->host.name, no_proxy)) - it wasn't specified
-        non-proxy */
+     if(!proxy)
+       proxy = curl_getenv("ALL_PROXY");
+   }
 +#endif /* WIN32 */
-   free(no_proxy);
  
- #else /* !CURL_DISABLE_HTTP */
+   return proxy;
+ }
diff --git a/external/curl/curl-msvc-disable-protocols.patch.1 b/external/curl/curl-msvc-disable-protocols.patch.1
index 38ff5ccb5ac0..c8747a5fcc1d 100644
--- a/external/curl/curl-msvc-disable-protocols.patch.1
+++ b/external/curl/curl-msvc-disable-protocols.patch.1
@@ -22,3 +22,14 @@ disable protocols nobody needs in MSVC build
 +#define CURL_DISABLE_TFTP 1
 +
  #endif /* HEADER_CURL_CONFIG_WIN32_H */
+--- curl/winbuild/MakefileBuild.vc.orig	2017-10-23 23:41:21.393200000 +0200
++++ curl/winbuild/MakefileBuild.vc	2017-10-23 23:34:16.028000000 +0200
+@@ -431,7 +431,7 @@
+ 
+ EXE_OBJS = $(CURL_OBJS) $(CURL_DIROBJ)\curl.res
+ 
+-all : $(TARGET) $(PROGRAM_NAME)
++all : $(TARGET)
+ 
+ package: $(TARGET)
+ 	@cd $(DIRDIST)
diff --git a/external/curl/curl-msvc-schannel.patch.1 b/external/curl/curl-msvc-schannel.patch.1
deleted file mode 100644
index 96768aa3f92c..000000000000
--- a/external/curl/curl-msvc-schannel.patch.1
+++ /dev/null
@@ -1,22 +0,0 @@
-MSVC: use WNT native Schannel SSL/TLS implementation
-
---- curl/lib/Makefile.vc12.old	2013-11-19 00:00:29.044499752 +0100
-+++ curl/lib/Makefile.vc12	2013-11-19 00:01:29.135499684 +0100
-@@ -260,7 +260,7 @@
- TARGET = $(LIBCURL_DYN_LIB_REL)
- DIROBJ = $(CFG)
- LNK    = $(LNKDLL) $(WINLIBS) /out:$(DIROBJ)\$(TARGET) /IMPLIB:$(DIROBJ)\$(LIBCURL_IMP_LIB_REL)
--CC     = $(CCNODBG) $(RTLIB)
-+CC     = $(CCNODBG) $(RTLIB) $(CFLAGSWINSSL)
- CFGSET = TRUE
- RESOURCE = $(DIROBJ)\libcurl.res
- !ENDIF
-@@ -427,7 +427,7 @@
- TARGET = $(LIBCURL_DYN_LIB_DBG)
- DIROBJ = $(CFG)
- LNK    = $(LNKDLL) $(WINLIBS) /DEBUG /out:$(DIROBJ)\$(TARGET) /IMPLIB:$(DIROBJ)\$(LIBCURL_IMP_LIB_DBG) /PDB:$(DIROBJ)\$(LIBCURL_DYN_LIB_PDB)
--CC     = $(CCDEBUG) $(RTLIBD)
-+CC     = $(CCDEBUG) $(RTLIBD) $(CFLAGSWINSSL)
- CFGSET = TRUE
- RESOURCE = $(DIROBJ)\libcurl.res
- !ENDIF
diff --git a/external/curl/curl-msvc.patch.1 b/external/curl/curl-msvc.patch.1
index 57a292bb69a3..80160958c99d 100644
--- a/external/curl/curl-msvc.patch.1
+++ b/external/curl/curl-msvc.patch.1
@@ -1,27 +1,27 @@
-MSVC: using SOLARINC and EXCFLAGS
+MSVC: using SOLARINC
 
---- curl/lib/Makefile.vc12	2012-05-24 12:07:02.000000000 -0400
-+++ curl/lib/Makefile.vc12	2012-10-29 11:53:44.658809300 -0400
-@@ -117,7 +117,7 @@
- ZLIBLIBSDLL  = zdll.lib
- ZLIBLIBS     = zlib.lib
- WINLIBS      = ws2_32.lib wldap32.lib advapi32.lib
--CFLAGS       = $(CFLAGS)
-+CFLAGS       = $(CFLAGS) $(EXCFLAGS)
+--- curl/winbuild/MakefileBuild.vc.orig	2017-10-23 16:36:07.713550851 +0200
++++ curl/winbuild/MakefileBuild.vc	2017-10-23 16:38:19.301547594 +0200
+@@ -60,7 +60,7 @@
+ !ELSE
+ CC_NODEBUG  = $(CC) /O2 /DNDEBUG
+ CC_DEBUG    = $(CC) /Od /D_DEBUG /RTC1 /Z7 /LDd
+-CFLAGS      = /I. /I ../lib /I../include /nologo /W4 /wd4127 /EHsc /DWIN32 /FD /c /DBUILDING_LIBCURL
++CFLAGS      = /I. /I ../lib /I../include /nologo /W4 /wd4127 /EHsc /DWIN32 /FD /c /DBUILDING_LIBCURL $(SOLARINC)
+ !ENDIF
  
- CFGSET       = FALSE
+ LFLAGS     = /nologo /machine:$(MACHINE)
+@@ -300,11 +300,11 @@
+ # CURL_XX macros are for the curl.exe command
  
-@@ -620,11 +620,11 @@
- debug-dll-ssl-dll\libcurl.res \
- debug-dll-zlib-dll\libcurl.res \
- debug-dll-ssl-dll-zlib-dll\libcurl.res: libcurl.rc
--	rc /dDEBUGBUILD=1 /Fo $@ libcurl.rc
-+	rc $(SOLARINC) /dDEBUGBUILD=1 /Fo $@ libcurl.rc
-
- release-dll\libcurl.res \
- release-dll-ssl-dll\libcurl.res \
- release-dll-zlib-dll\libcurl.res \
- release-dll-ssl-dll-zlib-dll\libcurl.res: libcurl.rc
--	rc /dDEBUGBUILD=0 /Fo $@ libcurl.rc
-+	rc $(SOLARINC) /dDEBUGBUILD=0 /Fo $@ libcurl.rc
- !ENDIF  # End of case where a config was provided.
+ !IF "$(DEBUG)"=="yes"
+-RC_FLAGS = /dDEBUGBUILD=1 /Fo $@ $(LIBCURL_SRC_DIR)\libcurl.rc
++RC_FLAGS = $(SOLARINC) /dDEBUGBUILD=1 /Fo $@ $(LIBCURL_SRC_DIR)\libcurl.rc
+ CURL_CC       = $(CC_DEBUG) $(RTLIB_DEBUG)
+ CURL_RC_FLAGS = /i../include /dDEBUGBUILD=1 /Fo $@ $(CURL_SRC_DIR)\curl.rc
+ !ELSE
+-RC_FLAGS = /dDEBUGBUILD=0 /Fo $@ $(LIBCURL_SRC_DIR)\libcurl.rc
++RC_FLAGS = $(SOLARINC) /dDEBUGBUILD=0 /Fo $@ $(LIBCURL_SRC_DIR)\libcurl.rc
+ CURL_CC       = $(CC_NODEBUG) $(RTLIB)
+ CURL_RC_FLAGS = /i../include /dDEBUGBUILD=0 /Fo $@ $(CURL_SRC_DIR)\curl.rc
+ !ENDIF
diff --git a/external/curl/curl-osx.patch.1 b/external/curl/curl-osx.patch.1
deleted file mode 100644
index 7694a1dcda2c..000000000000
--- a/external/curl/curl-osx.patch.1
+++ /dev/null
@@ -1,285 +0,0 @@
-From efebf4d4f882a57a98a0653d21d543cd4132d23d Mon Sep 17 00:00:00 2001
-From: Palo Markovic <pavol.markovic@kompiler.info>
-Date: Sat, 18 Mar 2017 16:37:02 +1300
-Subject: [PATCH] macOS: Fixed crash on 10.8 caused by missing connectx()
- function
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The connectx() function call appeared in Darwin 15.0.0
-That covers OS X 10.11, iOS 9 and tvOS 9.
-
-Because connectx is not declared with weak_import attribute it’s not possible
-to build libcurl on OS X 10.11 and later and target systems which don’t have
-_connectx symbol declared in libsystem_kernel.dylib (i.e. OS 10.8 and earlier).
-
-Solution is to use connectx only on platforms that officially support it
-i.e. by defining CFLAGS="-mmacosx-version-min=10.11" in configure step.
-
-Note: It is possible to conditionally use connectx() in libcurl targeting
-range of systems based on availability determined during runtime using dlsym().
-
-[Bug: https://github.com/curl/curl/issues/1330]
----
- lib/connect.c    |  2 +-
- lib/curl_setup.h | 16 ++++++++++++++++
- lib/url.c        |  2 +-
- 3 files changed, 18 insertions(+), 2 deletions(-)
-
-diff --git a/lib/connect.c b/lib/connect.c
-index 197eff242f..33251914b8 100644
---- a/lib/connect.c
-+++ b/lib/connect.c
-@@ -1075,7 +1075,7 @@ static CURLcode singleipconnect(struct connectdata *conn,
-   /* Connect TCP sockets, bind UDP */
-   if(!isconnected && (conn->socktype == SOCK_STREAM)) {
-     if(conn->bits.tcp_fastopen) {
--#if defined(CONNECT_DATA_IDEMPOTENT) /* OS X */
-+#if defined(HAVE_DARWIN_CONNECTX) /* Darwin */
-       sa_endpoints_t endpoints;
-       endpoints.sae_srcif = 0;
-       endpoints.sae_srcaddr = NULL;
-diff --git a/lib/curl_setup.h b/lib/curl_setup.h
-index 0fe3633ec7..8643e1fd28 100644
---- a/lib/curl_setup.h
-+++ b/lib/curl_setup.h
-@@ -762,4 +762,20 @@ endings either CRLF or LF so 't' is appropriate.
- #  endif
- # endif
- 
-+/* Detect Darwin connectx() function availability.
-+ * The connectx() function call appeared in Darwin 15.0.0
-+ * but it's not declared using availability attribute.
-+ */
-+#if defined(__MAC_OS_X_VERSION_MIN_REQUIRED)
-+#  if (__MAC_OS_X_VERSION_MIN_REQUIRED >= 101100)
-+#    define HAVE_DARWIN_CONNECTX 1
-+#  endif
-+#elif defined(__IPHONE_OS_VERSION_MIN_REQUIRED)
-+#  if (__IPHONE_OS_VERSION_MIN_REQUIRED >= 90000)
-+#    define HAVE_DARWIN_CONNECTX 1
-+#  endif
-+#elif defined(CONNECT_DATA_IDEMPOTENT)  /* Fallback for other Darwin OS */
-+#  define HAVE_DARWIN_CONNECTX 1
-+#endif
-+
- #endif /* HEADER_CURL_SETUP_H */
-diff --git a/lib/url.c b/lib/url.c
-index 03feaa20f7..08fbe5132b 100644
---- a/lib/url.c
-+++ b/lib/url.c
-@@ -2834,7 +2834,7 @@ CURLcode Curl_setopt(struct Curl_easy *data, CURLoption option,
-     data->set.tcp_keepintvl = va_arg(param, long);
-     break;
-   case CURLOPT_TCP_FASTOPEN:
--#if defined(CONNECT_DATA_IDEMPOTENT) || defined(MSG_FASTOPEN)
-+#if defined(HAVE_DARWIN_CONNECTX) || defined(MSG_FASTOPEN)
-     data->set.tcp_fastopen = (0 != va_arg(param, long))?TRUE:FALSE;
- #else
-     result = CURLE_NOT_BUILT_IN;
-From 45756a8a23967570da1390f9b1475c1db38a52d1 Mon Sep 17 00:00:00 2001
-From: Palo Markovic <pavol.markovic@kompiler.info>
-Date: Sat, 25 Mar 2017 13:20:51 +1300
-Subject: [PATCH] macOS: moved connectx check to configuration phase
-
----
- acinclude.m4     | 40 ++++++++++++++++++++++++++++++++++++++++
- configure.ac     |  1 +
- lib/connect.c    |  2 +-
- lib/curl_setup.h | 16 ----------------
- lib/url.c        |  2 +-
- 5 files changed, 43 insertions(+), 18 deletions(-)
-
-diff --git a/acinclude.m4 b/acinclude.m4
-index 2abae8d8ad..769e67c510 100644
---- a/acinclude.m4
-+++ b/acinclude.m4
-@@ -3243,3 +3243,43 @@ AC_DEFUN([CURL_MAC_CFLAGS], [
-   fi
- 
- ])
-+
-+
-+dnl CURL_CHECK_FUNC_CONNECTX
-+dnl
-+dnl Check if connectx() function is present.
-+dnl The connectx() function call appeared in Darwin 15.0.0
-+dnl but it's not declared using availability attribute.
-+dnl Additionally _connectx symbol is part of OS X 10.9/10.10
-+dnl system lib but does not have specified functionality.
-+dnl
-+
-+AC_DEFUN([CURL_CHECK_FUNC_CONNECTX], [
-+  AC_REQUIRE([CURL_MAC_CFLAGS])dnl
-+  AC_CHECK_FUNCS([connectx])
-+  AC_MSG_CHECKING([if connectx is available in deployment target])
-+  AC_COMPILE_IFELSE(
-+    [AC_LANG_PROGRAM([[
-+#if defined(HAVE_CONNECTX)
-+#  include <Availability.h>
-+#  if defined(__MAC_OS_X_VERSION_MIN_REQUIRED)
-+#    if (__MAC_OS_X_VERSION_MIN_REQUIRED < 101100)
-+#      error Function requires deployment target OS X 10.11 or later
-+#    endif
-+#  elif defined(__IPHONE_OS_VERSION_MIN_REQUIRED)
-+#    if (__IPHONE_OS_VERSION_MIN_REQUIRED < 90000)
-+#      error Function requires deployment target iOS 9.0 or later
-+#    endif
-+#  endif
-+#else
-+#  error Function not present in the headers
-+#endif
-+    ]])],
-+    [
-+      AC_DEFINE(HAVE_VALID_CONNECTX, 1,
-+        [Set to 1 if connectx() function have specified functionality.])
-+      AC_MSG_RESULT([yes])
-+    ],
-+    [AC_MSG_RESULT([no])]
-+  )
-+])
-diff --git a/configure.ac b/configure.ac
-index abd0def369..a3930447c3 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -3226,6 +3226,7 @@ CURL_CHECK_FUNC_BASENAME
- CURL_CHECK_FUNC_CLOSESOCKET
- CURL_CHECK_FUNC_CLOSESOCKET_CAMEL
- CURL_CHECK_FUNC_CONNECT
-+CURL_CHECK_FUNC_CONNECTX
- CURL_CHECK_FUNC_FCNTL
- CURL_CHECK_FUNC_FDOPEN
- CURL_CHECK_FUNC_FREEADDRINFO
-diff --git a/lib/connect.c b/lib/connect.c
-index 33251914b8..8c5e45aea5 100644
---- a/lib/connect.c
-+++ b/lib/connect.c
-@@ -1075,7 +1075,7 @@ static CURLcode singleipconnect(struct connectdata *conn,
-   /* Connect TCP sockets, bind UDP */
-   if(!isconnected && (conn->socktype == SOCK_STREAM)) {
-     if(conn->bits.tcp_fastopen) {
--#if defined(HAVE_DARWIN_CONNECTX) /* Darwin */
-+#if defined(HAVE_VALID_CONNECTX) /* Darwin */
-       sa_endpoints_t endpoints;
-       endpoints.sae_srcif = 0;
-       endpoints.sae_srcaddr = NULL;
-diff --git a/lib/curl_setup.h b/lib/curl_setup.h
-index 8643e1fd28..0fe3633ec7 100644
---- a/lib/curl_setup.h
-+++ b/lib/curl_setup.h
-@@ -762,20 +762,4 @@ endings either CRLF or LF so 't' is appropriate.
- #  endif
- # endif
- 
--/* Detect Darwin connectx() function availability.
-- * The connectx() function call appeared in Darwin 15.0.0
-- * but it's not declared using availability attribute.
-- */
--#if defined(__MAC_OS_X_VERSION_MIN_REQUIRED)
--#  if (__MAC_OS_X_VERSION_MIN_REQUIRED >= 101100)
--#    define HAVE_DARWIN_CONNECTX 1
--#  endif
--#elif defined(__IPHONE_OS_VERSION_MIN_REQUIRED)
--#  if (__IPHONE_OS_VERSION_MIN_REQUIRED >= 90000)
--#    define HAVE_DARWIN_CONNECTX 1
--#  endif
--#elif defined(CONNECT_DATA_IDEMPOTENT)  /* Fallback for other Darwin OS */
--#  define HAVE_DARWIN_CONNECTX 1
--#endif
--
- #endif /* HEADER_CURL_SETUP_H */
-diff --git a/lib/url.c b/lib/url.c
-index 08fbe5132b..7160ae041d 100644
---- a/lib/url.c
-+++ b/lib/url.c
-@@ -2834,7 +2834,7 @@ CURLcode Curl_setopt(struct Curl_easy *data, CURLoption option,
-     data->set.tcp_keepintvl = va_arg(param, long);
-     break;
-   case CURLOPT_TCP_FASTOPEN:
--#if defined(HAVE_DARWIN_CONNECTX) || defined(MSG_FASTOPEN)
-+#if defined(HAVE_VALID_CONNECTX) || defined(MSG_FASTOPEN)
-     data->set.tcp_fastopen = (0 != va_arg(param, long))?TRUE:FALSE;
- #else
-     result = CURLE_NOT_BUILT_IN;
-From 113088ac81edbb9d51582a114d006bf60e3e6a87 Mon Sep 17 00:00:00 2001
-From: Palo Markovic <pavol.markovic@kompiler.info>
-Date: Wed, 5 Apr 2017 06:04:42 +1200
-Subject: [PATCH] macOS: added connectx check for cmake
-
----
- CMake/CurlTests.c       | 18 ++++++++++++++++++
- CMakeLists.txt          |  9 +++++++++
- lib/curl_config.h.cmake |  6 ++++++
- 3 files changed, 33 insertions(+)
-
-diff --git a/CMake/CurlTests.c b/CMake/CurlTests.c
-index bc36c8ef7d..7077059f9c 100644
---- a/CMake/CurlTests.c
-+++ b/CMake/CurlTests.c
-@@ -533,3 +533,21 @@ main() {
-     return 0;
- }
- #endif
-+#ifdef HAVE_VALID_CONNECTX
-+#  include <Availability.h>
-+#  include <sys/socket.h>
-+#  if defined(__MAC_OS_X_VERSION_MIN_REQUIRED)
-+#    if (__MAC_OS_X_VERSION_MIN_REQUIRED < 101100)
-+#      error Function requires deployment target OS X 10.11 or later
-+#    endif
-+#  elif defined(__IPHONE_OS_VERSION_MIN_REQUIRED)
-+#    if (__IPHONE_OS_VERSION_MIN_REQUIRED < 90000)
-+#      error Function requires deployment target iOS 9.0 or later
-+#    endif
-+#  endif
-+
-+main() {
-+  connectx(0, 0, 0, 0, 0, 0, 0, 0);
-+  return 0;
-+}
-+#endif
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 8390c38c99..ab8be51ebc 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -849,6 +849,15 @@ check_symbol_exists(fcntl          "${CURL_INCLUDES}" HAVE_FCNTL)
- check_symbol_exists(ioctl          "${CURL_INCLUDES}" HAVE_IOCTL)
- check_symbol_exists(setsockopt     "${CURL_INCLUDES}" HAVE_SETSOCKOPT)
- 
-+# The connectx() function call appeared in Darwin 15.0.0
-+# but it's not declared using availability attribute.
-+# Additionally _connectx symbol is part of OS X 10.9/10.10
-+# system lib but does not have specified functionality.
-+check_symbol_exists(connectx       "${CURL_INCLUDES}" HAVE_CONNECTX)
-+if(HAVE_CONNECTX)
-+  curl_internal_test_run(HAVE_VALID_CONNECTX)
-+endif(HAVE_CONNECTX)
-+
- # symbol exists in win32, but function does not.
- check_function_exists(inet_pton HAVE_INET_PTON)
- 
-diff --git a/lib/curl_config.h.cmake b/lib/curl_config.h.cmake
-index 9fcdd97f98..6fc4415a8d 100644
---- a/lib/curl_config.h.cmake
-+++ b/lib/curl_config.h.cmake
-@@ -130,6 +130,9 @@
- /* Define to 1 if bool is an available type. */
- #cmakedefine HAVE_BOOL_T 1
- 
-+/* Define to 1 if you have the connectx function. */
-+#cmakedefine HAVE_CONNECTX 1
-+
- /* Define to 1 if you have the clock_gettime function and monotonic timer. */
- #cmakedefine HAVE_CLOCK_GETTIME_MONOTONIC 1
- 
-@@ -719,6 +722,9 @@
- /* Define to 1 if you have the <utime.h> header file. */
- #cmakedefine HAVE_UTIME_H 1
- 
-+/* Define to 1 if you have valid connectx function. */
-+#cmakedefine HAVE_VALID_CONNECTX 1
-+
- /* Define to 1 if compiler supports C99 variadic macro style. */
- #cmakedefine HAVE_VARIADIC_MACROS_C99 1
- 
diff --git a/external/curl/zlib.patch.0 b/external/curl/zlib.patch.0
index 87614c7703f7..b3e821039740 100644
--- a/external/curl/zlib.patch.0
+++ b/external/curl/zlib.patch.0
@@ -45,9 +45,9 @@
 + else
 +  ZLIB_LIBS=""
 +
+   if test -z "$OPT_ZLIB" ; then
  
      if test -n "$PKG_CONFIG"; then
-       PKGCONFIG="$PKG_CONFIG"
 @@ -21005,6 +21020,7 @@
  $as_echo "$as_me: found both libz and libz.h header" >&6;}
      curl_zlib_msg="enabled"
@@ -87,9 +87,9 @@
 + else
 +  ZLIB_LIBS=""
 +
-   CURL_CHECK_PKGCONFIG(zlib)
+   if test -z "$OPT_ZLIB" ; then
+     CURL_CHECK_PKGCONFIG(zlib)
  
-   if test "$PKGCONFIG" != "no" ; then
 @@ -975,6 +986,7 @@
      AC_MSG_NOTICE([found both libz and libz.h header])
      curl_zlib_msg="enabled"