curl-d755a5f7c009dd63a61b2c745180d8ba937cbfeb.patch

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 1b19c681d..ae12c4c87 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -706,7 +706,7 @@ if(USE_QUICHE)
     message(FATAL_ERROR "Only one HTTP/3 backend can be selected!")
   endif()
   find_package(QUICHE REQUIRED)
-  CheckQuicSupportInOpenSSL()
+#  CheckQuicSupportInOpenSSL()
   set(USE_QUICHE ON)
   include_directories(${QUICHE_INCLUDE_DIRS})
   list(APPEND CURL_LIBS ${QUICHE_LIBRARIES})
@@ -733,6 +733,12 @@ if(NOT CURL_DISABLE_SRP AND (HAVE_GNUTLS_SRP OR HAVE_OPENSSL_SRP))
   set(USE_TLS_SRP 1)
 endif()
 
+if(WIN32)
+  #for quiche static
+  list(APPEND CURL_LIBS "ntdll")
+  list(APPEND CURL_LIBS "Userenv")
+endif()
+
 if(NOT CURL_DISABLE_LDAP)
   if(WIN32)
     option(USE_WIN32_LDAP "Use Windows LDAP implementation" ON)
diff --git a/include/curl/curl.h b/include/curl/curl.h
index bf71d82fb..46c92f380 100644
--- a/include/curl/curl.h
+++ b/include/curl/curl.h
@@ -2209,7 +2209,13 @@ typedef enum {
 
   /* set a specific client IP for HAProxy PROXY protocol header? */
   CURLOPT(CURLOPT_HAPROXY_CLIENT_IP, CURLOPTTYPE_STRINGPOINT, 323),
-
+  
+  CURLOPT(CURLOPT_TLS_EXTENSION_PERMUTATION, CURLOPTTYPE_STRINGPOINT, 324),
+  CURLOPT(CURLOPT_HTTP2_PSEUDO_HEADERS_ORDER, CURLOPTTYPE_STRINGPOINT, 325),
+  CURLOPT(CURLOPT_HTTP2_SETTINGS, CURLOPTTYPE_STRINGPOINT, 326),
+  CURLOPT(CURLOPT_HTTP2_WINDOW_UPDATE, CURLOPTTYPE_LONG, 327),
+  CURLOPT(CURLOPT_HTTP2_STREAMS, CURLOPTTYPE_STRINGPOINT, 328),
+  CURLOPT(CURLOPT_HTTP2_STREAM_ID, CURLOPTTYPE_LONG, 329),
   CURLOPT_LASTENTRY /* the last unused */
 } CURLoption;
 
diff --git a/lib/cf-h2-proxy.c b/lib/cf-h2-proxy.c
index dbc895d26..a5058560f 100644
--- a/lib/cf-h2-proxy.c
+++ b/lib/cf-h2-proxy.c
@@ -48,7 +48,7 @@
 #define PROXY_H2_CHUNK_SIZE  (16*1024)
 
 #define PROXY_HTTP2_HUGE_WINDOW_SIZE (100 * 1024 * 1024)
-#define H2_TUNNEL_WINDOW_SIZE        (10 * 1024 * 1024)
+#define H2_TUNNEL_WINDOW_SIZE        (15 * 1024 * 1024)
 
 #define PROXY_H2_NW_RECV_CHUNKS  (H2_TUNNEL_WINDOW_SIZE / PROXY_H2_CHUNK_SIZE)
 #define PROXY_H2_NW_SEND_CHUNKS   1
diff --git a/lib/curl_setup.h b/lib/curl_setup.h
index ba14972e2..2b357e281 100644
--- a/lib/curl_setup.h
+++ b/lib/curl_setup.h
@@ -844,4 +844,4 @@ int getpwuid_r(uid_t uid, struct passwd *pwd, char *buf,
 #define OPENSSL_SUPPRESS_DEPRECATED
 #endif
 
-#endif /* HEADER_CURL_SETUP_H */
+#endif /* HEADER_CURL_SETUP_H */
\ No newline at end of file
diff --git a/lib/dynhds.c b/lib/dynhds.c
index 979b3e825..602d0a1fb 100644
--- a/lib/dynhds.c
+++ b/lib/dynhds.c
@@ -133,6 +133,16 @@ void Curl_dynhds_set_opts(struct dynhds *dynhds, int opts)
 {
   dynhds->opts = opts;
 }
+void Curl_dynhds_set_opt(struct dynhds *dynhds, int opt)
+{
+  dynhds->opts |= opt;
+}
+
+void Curl_dynhds_del_opt(struct dynhds *dynhds, int opt)
+{
+  dynhds->opts &= ~opt;
+}
+
 
 struct dynhds_entry *Curl_dynhds_getn(struct dynhds *dynhds, size_t n)
 {
diff --git a/lib/dynhds.h b/lib/dynhds.h
index 8a053480e..f9f38e8b1 100644
--- a/lib/dynhds.h
+++ b/lib/dynhds.h
@@ -53,7 +53,7 @@ struct dynhds {
 
 #define DYNHDS_OPT_NONE          (0)
 #define DYNHDS_OPT_LOWERCASE     (1 << 0)
-
+#define DYNHDS_OPT_LOWERCASE_VAL (1 << 1)
 /**
  * Init for use on first time or after a reset.
  * Allow `max_entries` headers to be added, 0 for unlimited.
@@ -82,7 +82,8 @@ size_t Curl_dynhds_count(struct dynhds *dynhds);
  * This will not have an effect on already existing headers.
  */
 void Curl_dynhds_set_opts(struct dynhds *dynhds, int opts);
-
+void Curl_dynhds_set_opt(struct dynhds *dynhds, int opt);
+void Curl_dynhds_del_opt(struct dynhds *dynhds, int opt);
 /**
  * Return the n-th header entry or NULL if it does not exist.
  */
diff --git a/lib/easyoptions.c b/lib/easyoptions.c
index e69c658b0..e26d55e62 100644
--- a/lib/easyoptions.c
+++ b/lib/easyoptions.c
@@ -133,6 +133,11 @@ struct curl_easyoption Curl_easyopts[] = {
   {"HSTS_CTRL", CURLOPT_HSTS_CTRL, CURLOT_LONG, 0},
   {"HTTP09_ALLOWED", CURLOPT_HTTP09_ALLOWED, CURLOT_LONG, 0},
   {"HTTP200ALIASES", CURLOPT_HTTP200ALIASES, CURLOT_SLIST, 0},
+  {"HTTP2_PSEUDO_HEADERS_ORDER", CURLOPT_HTTP2_PSEUDO_HEADERS_ORDER, CURLOT_STRING, 0},
+  {"HTTP2_SETTINGS", CURLOPT_HTTP2_SETTINGS, CURLOT_STRING, 0},
+  {"HTTP2_STREAMS", CURLOPT_HTTP2_STREAMS, CURLOT_STRING, 0},
+  {"HTTP2_WINDOW_UPDATE", CURLOPT_HTTP2_WINDOW_UPDATE, CURLOT_LONG, 0},
+  {"HTTP2_STREAM_ID", CURLOPT_HTTP2_STREAM_ID, CURLOT_LONG, 0},
   {"HTTPAUTH", CURLOPT_HTTPAUTH, CURLOT_VALUES, 0},
   {"HTTPGET", CURLOPT_HTTPGET, CURLOT_LONG, 0},
   {"HTTPHEADER", CURLOPT_HTTPHEADER, CURLOT_SLIST, 0},
@@ -373,6 +378,6 @@ struct curl_easyoption Curl_easyopts[] = {
  */
 int Curl_easyopts_check(void)
 {
-  return ((CURLOPT_LASTENTRY%10000) != (323 + 1));
+  return ((CURLOPT_LASTENTRY%10000) != (329 + 1));
 }
 #endif
diff --git a/lib/http.c b/lib/http.c
index 40ef70df5..ffcc9068b 100644
--- a/lib/http.c
+++ b/lib/http.c
@@ -4869,12 +4869,33 @@ static bool h2_non_field(const char *name, size_t namelen)
   return FALSE;
 }
 
+static CURLcode h2_check_pseudo_header_order(const char *order)
+{
+  if(strlen(order) != 4)
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+
+  // :method should always be first
+  if(order[0] != 'm')
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+
+  // All pseudo-headers must be present
+  if(!strchr(order, 'm') ||
+     !strchr(order, 'a') ||
+     !strchr(order, 's') ||
+     !strchr(order, 'p'))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+
+  return CURLE_OK;
+}
+
+
 CURLcode Curl_http_req_to_h2(struct dynhds *h2_headers,
                              struct httpreq *req, struct Curl_easy *data)
 {
   const char *scheme = NULL, *authority = NULL;
   struct dynhds_entry *e;
   size_t i;
+  char *order = "masp";
   CURLcode result;
 
   DEBUGASSERT(req);
@@ -4908,25 +4929,44 @@ CURLcode Curl_http_req_to_h2(struct dynhds *h2_headers,
 
   Curl_dynhds_reset(h2_headers);
   Curl_dynhds_set_opts(h2_headers, DYNHDS_OPT_LOWERCASE);
-  result = Curl_dynhds_add(h2_headers, STRCONST(HTTP_PSEUDO_METHOD),
-                           req->method, strlen(req->method));
-  if(!result && scheme) {
-    result = Curl_dynhds_add(h2_headers, STRCONST(HTTP_PSEUDO_SCHEME),
-                             scheme, strlen(scheme));
-  }
-  if(!result && authority) {
-    result = Curl_dynhds_add(h2_headers, STRCONST(HTTP_PSEUDO_AUTHORITY),
-                             authority, strlen(authority));
-  }
-  if(!result && req->path) {
-    result = Curl_dynhds_add(h2_headers, STRCONST(HTTP_PSEUDO_PATH),
-                             req->path, strlen(req->path));
-  }
+  if (data->set.str[STRING_HTTP2_PSEUDO_HEADERS_ORDER]) {
+    order = data->set.str[STRING_HTTP2_PSEUDO_HEADERS_ORDER];
+  }
+  result = h2_check_pseudo_header_order(order);
+  for(i = 0; !result && i < strlen(order); ++i) {
+    switch(order[i]) {
+      case 'm':
+        result = Curl_dynhds_add(h2_headers, STRCONST(HTTP_PSEUDO_METHOD),
+                                 req->method, strlen(req->method));
+        break;
+      case 'a':
+        if(authority) {
+          result = Curl_dynhds_add(h2_headers, STRCONST(HTTP_PSEUDO_AUTHORITY),
+                                   authority, strlen(authority));
+        }
+        break;
+      case 's':
+        if(scheme) {
+          result = Curl_dynhds_add(h2_headers, STRCONST(HTTP_PSEUDO_SCHEME),
+                                   scheme, strlen(scheme));
+        }
+        break;
+      case 'p':
+        if(req->path) {
+          result = Curl_dynhds_add(h2_headers, STRCONST(HTTP_PSEUDO_PATH),
+                                   req->path, strlen(req->path));
+        }
+        break;
+    }
+   }
   for(i = 0; !result && i < Curl_dynhds_count(&req->headers); ++i) {
     e = Curl_dynhds_getn(&req->headers, i);
     if(!h2_non_field(e->name, e->namelen)) {
+     if(e->namelen == 2 && strcasecompare(e->name, "te"))
+        Curl_dynhds_set_opt(h2_headers, DYNHDS_OPT_LOWERCASE_VAL);
       result = Curl_dynhds_add(h2_headers, e->name, e->namelen,
                                e->value, e->valuelen);
+      Curl_dynhds_del_opt(h2_headers, DYNHDS_OPT_LOWERCASE_VAL);
     }
   }
 
diff --git a/lib/http2.c b/lib/http2.c
index c8b059498..3583efbb0 100644
--- a/lib/http2.c
+++ b/lib/http2.c
@@ -69,7 +69,7 @@
  * use 16K as chunk size, as that fits H2 DATA frames well */
 #define H2_CHUNK_SIZE           (16 * 1024)
 /* this is how much we want "in flight" for a stream */
-#define H2_STREAM_WINDOW_SIZE   (10 * 1024 * 1024)
+#define H2_STREAM_WINDOW_SIZE   (15 * 1024 * 1024)
 /* on receiving from TLS, we prep for holding a full stream window */
 #define H2_NW_RECV_CHUNKS       (H2_STREAM_WINDOW_SIZE / H2_CHUNK_SIZE)
 /* on send into TLS, we just want to accumulate small frames */
@@ -87,24 +87,66 @@
  * will block their received QUOTA in the connection window. And if we
  * run out of space, the server is blocked from sending us any data.
  * See #10988 for an issue with this. */
-#define HTTP2_HUGE_WINDOW_SIZE (100 * H2_STREAM_WINDOW_SIZE)
+#define HTTP2_HUGE_WINDOW_SIZE (1 * H2_STREAM_WINDOW_SIZE)
 
-#define H2_SETTINGS_IV_LEN  3
+#define H2_SETTINGS_IV_LEN  8
 #define H2_BINSETTINGS_LEN 80
 
 static int populate_settings(nghttp2_settings_entry *iv,
                              struct Curl_easy *data)
 {
-  iv[0].settings_id = NGHTTP2_SETTINGS_MAX_CONCURRENT_STREAMS;
-  iv[0].value = Curl_multi_max_concurrent_streams(data->multi);
-
-  iv[1].settings_id = NGHTTP2_SETTINGS_INITIAL_WINDOW_SIZE;
-  iv[1].value = H2_STREAM_WINDOW_SIZE;
-
-  iv[2].settings_id = NGHTTP2_SETTINGS_ENABLE_PUSH;
-  iv[2].value = data->multi->push_cb != NULL;
+  // TODO check if the http2 settings is valid
+  int i = 0;
+  char *delimiter = ";";
+
+  // Use chrome's settings as default
+  char *http2_settings = "1:65536;2:0;4:6291456;6:262144";
+  if(data->set.str[STRING_HTTP2_SETTINGS]) {
+    http2_settings = data->set.str[STRING_HTTP2_SETTINGS];
+  }
+  char *tmp = strdup(http2_settings);
+  char *setting = strtok(tmp, delimiter);
+   // loop through the string to extract all other tokens
+  while(setting != NULL) {
+    // deal with each setting
+    switch(setting[0]) {
+      case '1':
+        iv[i].settings_id = NGHTTP2_SETTINGS_HEADER_TABLE_SIZE;
+        iv[i].value = atoi(setting + 2);
+        i++;
+        break;
+      case '2':
+        iv[i].settings_id = NGHTTP2_SETTINGS_ENABLE_PUSH;
+        iv[i].value = atoi(setting + 2);
+        i++;
+        break;
+      case '3':
+        // FIXME We also need to notify curl_multi about this setting
+        iv[i].settings_id = NGHTTP2_SETTINGS_MAX_CONCURRENT_STREAMS;
+        iv[i].value = atoi(setting + 2);
+        i++;
+        break;
+      case '4':
+        iv[i].settings_id = NGHTTP2_SETTINGS_INITIAL_WINDOW_SIZE;
+        iv[i].value = atoi(setting + 2);
+        i++;
+        break;
+      case '5':
+        iv[i].settings_id = NGHTTP2_SETTINGS_MAX_FRAME_SIZE;
+        iv[i].value = atoi(setting + 2);
+        i++;
+        break;
+      case '6':
+        iv[i].settings_id = NGHTTP2_SETTINGS_MAX_HEADER_LIST_SIZE;
+        iv[i].value = atoi(setting + 2);
+        i++;
+        break;
+    }
+    setting = strtok(NULL, delimiter);
+  }
+  free(tmp);
 
-  return 3;
+  return i;
 }
 
 static size_t populate_binsettings(uint8_t *binsettings,
@@ -137,6 +179,95 @@ struct cf_h2_ctx {
   BIT(enable_push);
   BIT(nw_out_blocked);
 };
+static CURLcode http2_set_stream_priority(struct Curl_cfilter* cf,
+    struct Curl_easy* data,
+    int32_t stream_id,
+    int32_t dep_stream_id,
+    int32_t weight,
+    int exclusive
+)
+{
+    int rv;
+    struct cf_h2_ctx* ctx = cf->ctx;
+    nghttp2_priority_spec pri_spec;
+
+    nghttp2_priority_spec_init(&pri_spec, dep_stream_id, weight, exclusive);
+    rv = nghttp2_submit_priority(ctx->h2, NGHTTP2_FLAG_NONE,
+        stream_id, &pri_spec);
+    if (rv) {
+        failf(data, "nghttp2_submit_priority() failed: %s(%d)",
+            nghttp2_strerror(rv), rv);
+        return CURLE_HTTP2;
+    }
+
+    return CURLE_OK;
+}
+
+#if defined(_WIN32) || defined(_WIN64)
+char *strtok_r(char *str, const char *delim, char **saveptr) {
+    char *token;
+
+    if (str == NULL) {
+        str = *saveptr;
+    }
+
+    str += strspn(str, delim);
+    if (*str == '\0') {
+        return NULL;
+    }
+
+    token = str;
+
+    str = strpbrk(token, delim);
+    if (str == NULL) {
+        *saveptr = strchr(token, '\0');
+    } else {
+        *str = '\0';
+        *saveptr = str + 1;
+    }
+
+    return token;
+}
+#endif
+
+static CURLcode http2_set_stream_priorities(struct Curl_cfilter* cf,
+    struct Curl_easy* data)
+{
+    CURLcode result;
+    char* stream_delimiter = ",";
+    char* value_delimiter = ":";
+
+    if (!data->set.str[STRING_HTTP2_STREAMS])
+        return CURLE_OK;
+
+    char* tmp1 = strdup(data->set.str[STRING_HTTP2_STREAMS]);
+    char* end1;
+    char* stream = strtok_r(tmp1, stream_delimiter, &end1);
+
+    while (stream != NULL) {
+
+        char* tmp2 = strdup(stream);
+        char* end2;
+
+        int32_t stream_id = atoi(strtok_r(tmp2, value_delimiter, &end2));
+        int exclusive = atoi(strtok_r(NULL, value_delimiter, &end2));
+        int32_t dep_stream_id = atoi(strtok_r(NULL, value_delimiter, &end2));
+        int32_t weight = atoi(strtok_r(NULL, value_delimiter, &end2));
+
+        free(tmp2);
+
+        result = http2_set_stream_priority(cf, data, stream_id, dep_stream_id, weight, exclusive);
+        if (result) {
+            free(tmp1);
+            return result;
+        }
+
+        stream = strtok_r(NULL, stream_delimiter, &end1);
+    }
+
+    free(tmp1);
+    return CURLE_OK;
+}
 
 /* How to access `call_data` from a cf_h2 filter */
 #undef CF_CTX_CALL_DATA
@@ -496,15 +627,28 @@ static CURLcode cf_h2_ctx_init(struct Curl_cfilter *cf,
     }
   }
 
-  rc = nghttp2_session_set_local_window_size(ctx->h2, NGHTTP2_FLAG_NONE, 0,
-                                             HTTP2_HUGE_WINDOW_SIZE);
+  int current_window_size = nghttp2_session_get_local_window_size(ctx->h2);
+
+  // Use chrome's value as default
+  int window_update = 15663105;
+  if(data->set.http2_window_update) {
+    window_update = data->set.http2_window_update;
+  }
+
+  // printf("Using window update %d\n", window_update);
+
+  rc = nghttp2_session_set_local_window_size(
+      ctx->h2, NGHTTP2_FLAG_NONE, 0,
+        current_window_size + window_update);
   if(rc) {
     failf(data, "nghttp2_session_set_local_window_size() failed: %s(%d)",
           nghttp2_strerror(rc), rc);
     result = CURLE_HTTP2;
     goto out;
   }
-
+  result = http2_set_stream_priorities(cf, data);
+  if(result)
+    goto out;
   /* all set, traffic will be send on connect */
   result = CURLE_OK;
   CURL_TRC_CF(data, cf, "[0] created h2 session%s",
@@ -1750,11 +1894,15 @@ out:
   return rv;
 }
 
+#define CHROME_DEFAULT_STREAM_WEIGHT    (256)
+#define SAFARI_DEFAULT_STREAM_WEIGHT    (255)
+#define FIREFOX_DEFAULT_STREAM_WEIGHT   (42)
+
 static int sweight_wanted(const struct Curl_easy *data)
 {
   /* 0 weight is not set by user and we take the nghttp2 default one */
   return data->set.priority.weight?
-    data->set.priority.weight : NGHTTP2_DEFAULT_WEIGHT;
+    data->set.priority.weight : CHROME_DEFAULT_STREAM_WEIGHT;
 }
 
 static int sweight_in_effect(const struct Curl_easy *data)
@@ -1778,7 +1926,7 @@ static void h2_pri_spec(struct Curl_easy *data,
   int32_t depstream_id = depstream? depstream->id:0;
   nghttp2_priority_spec_init(pri_spec, depstream_id,
                              sweight_wanted(data),
-                             data->set.priority.exclusive);
+                             /* data->set.priority.exclusive */1);
   data->state.priority = *prio;
 }
 
@@ -1797,18 +1945,21 @@ static CURLcode h2_progress_egress(struct Curl_cfilter *cf,
 
   if(stream && stream->id > 0 &&
      ((sweight_wanted(data) != sweight_in_effect(data)) ||
-      (data->set.priority.exclusive != data->state.priority.exclusive) ||
-      (data->set.priority.parent != data->state.priority.parent)) ) {
+     (data->set.priority.exclusive != 1) ||
+     (data->set.priority.parent != data->state.priority.parent))) {
     /* send new weight and/or dependency */
     nghttp2_priority_spec pri_spec;
 
     h2_pri_spec(data, &pri_spec);
-    CURL_TRC_CF(data, cf, "[%d] Queuing PRIORITY", stream->id);
-    DEBUGASSERT(stream->id != -1);
-    rv = nghttp2_submit_priority(ctx->h2, NGHTTP2_FLAG_NONE,
-                                 stream->id, &pri_spec);
-    if(rv)
-      goto out;
+    if(stream->id != 1 && stream->id != data->set.http2_stream_id) {
+      DEBUGF(LOG_CF(data, cf, "[h2sid=%d] Queuing PRIORITY",
+                    stream->id));
+      DEBUGASSERT(stream->id != -1);
+      rv = nghttp2_submit_priority(ctx->h2, NGHTTP2_FLAG_NONE,
+                                    stream->id, &pri_spec);
+      if(rv)
+        goto out;
+    }
   }
 
   ctx->nw_out_blocked = 0;
@@ -2073,6 +2224,15 @@ static ssize_t h2_submit(struct stream_ctx **pstream,
   if(!nghttp2_session_check_request_allowed(ctx->h2))
     CURL_TRC_CF(data, cf, "send request NOT allowed (via nghttp2)");
 
+  if (data->set.http2_stream_id != 0 && cf->next) {
+      int status = nghttp2_session_set_next_stream_id(ctx->h2, data->set.http2_stream_id);
+      if (status != 0)
+      {
+          CURL_TRC_CF(data, cf, "nghttp2_session_set_next_stream_id error %d (via nghttp2)", status);
+          nwritten = -1;
+          goto out;
+      }
+  };
   switch(data->state.httpreq) {
   case HTTPREQ_POST:
   case HTTPREQ_POST_FORM:
diff --git a/lib/setopt.c b/lib/setopt.c
index 0d399adfe..fd06235bb 100644
--- a/lib/setopt.c
+++ b/lib/setopt.c
@@ -3170,6 +3170,37 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
   case CURLOPT_QUICK_EXIT:
     data->set.quick_exit = (0 != va_arg(param, long)) ? 1L:0L;
     break;
+  case CURLOPT_TLS_EXTENSION_PERMUTATION:
+      result = Curl_setstropt(&data->set.str[STRING_TLS_EXTENSION_PERMUTATION],
+          va_arg(param, char*));
+      break;
+#ifdef USE_HTTP2
+  case CURLOPT_HTTP2_PSEUDO_HEADERS_ORDER:
+    result = Curl_setstropt(&data->set.str[STRING_HTTP2_PSEUDO_HEADERS_ORDER],
+                          va_arg(param, char *));
+  break;
+  case CURLOPT_HTTP2_SETTINGS:
+    result = Curl_setstropt(&data->set.str[STRING_HTTP2_SETTINGS],
+                            va_arg(param, char *));
+    break;
+  case CURLOPT_HTTP2_WINDOW_UPDATE:
+    arg = va_arg(param, long);
+    if(arg < -1)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    data->set.http2_window_update = arg;
+    break;
+  case CURLOPT_HTTP2_STREAMS:
+    result = Curl_setstropt(&data->set.str[STRING_HTTP2_STREAMS],
+                            va_arg(param, char *));
+    break;
+  case CURLOPT_HTTP2_STREAM_ID:
+    arg = va_arg(param, long);
+    if(arg < -1)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    data->set.http2_stream_id = arg;
+    break;
+
+#endif
   default:
     /* unknown tag and its companion, just ignore: */
     result = CURLE_UNKNOWN_OPTION;
diff --git a/lib/url.c b/lib/url.c
index 61dad442d..166cc6f8a 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -3613,6 +3613,7 @@ static CURLcode create_conn(struct Curl_easy *data,
     data->set.str[STRING_SSL_CIPHER_LIST];
   data->set.ssl.primary.cipher_list13 =
     data->set.str[STRING_SSL_CIPHER13_LIST];
+  data->set.ssl.primary.extension_permutation = data->set.str[STRING_TLS_EXTENSION_PERMUTATION];
   data->set.ssl.primary.pinned_key =
     data->set.str[STRING_SSL_PINNEDPUBLICKEY];
   data->set.ssl.primary.cert_blob = data->set.blobs[BLOB_CERT];
diff --git a/lib/urldata.h b/lib/urldata.h
index dff26e6b4..9f88e5638 100644
--- a/lib/urldata.h
+++ b/lib/urldata.h
@@ -273,6 +273,7 @@ struct ssl_primary_config {
   char *clientcert;
   char *cipher_list;     /* list of ciphers to use */
   char *cipher_list13;   /* list of TLS 1.3 cipher suites to use */
+  char* extension_permutation;
   char *pinned_key;
   char *CRLfile;         /* CRL to check certificate revocation */
   struct curl_blob *cert_blob;
@@ -1600,7 +1601,9 @@ enum dupstring {
   STRING_SSL_EC_CURVES,
   STRING_AWS_SIGV4, /* Parameters for V4 signature */
   STRING_HAPROXY_CLIENT_IP,     /* CURLOPT_HAPROXY_CLIENT_IP */
-
+  STRING_HTTP2_PSEUDO_HEADERS_ORDER,
+  STRING_HTTP2_SETTINGS,
+  STRING_HTTP2_STREAMS,
   /* -- end of null-terminated strings -- */
 
   STRING_LASTZEROTERMINATED,
@@ -1608,7 +1611,7 @@ enum dupstring {
   /* -- below this are pointers to binary data that cannot be strdup'ed. --- */
 
   STRING_COPYPOSTFIELDS,  /* if POST, set the fields' values here */
-
+  STRING_TLS_EXTENSION_PERMUTATION,/* extension order */
   STRING_LAST /* not used, just an end-of-list marker */
 };
 
@@ -1920,6 +1923,8 @@ struct UserDefined {
 #ifdef USE_WEBSOCKETS
   BIT(ws_raw_mode);
 #endif
+  int http2_window_update;
+  int http2_stream_id;
 };
 
 struct Names {
diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
index 9f9c8d136..8ec355834 100644
--- a/lib/vtls/openssl.c
+++ b/lib/vtls/openssl.c
@@ -205,17 +205,17 @@
  * BoringSSL: no
  * LibreSSL: supported since 3.4.1 (released 2021-10-14)
  */
-#if ((OPENSSL_VERSION_NUMBER >= 0x10101000L && \
-      !defined(LIBRESSL_VERSION_NUMBER)) || \
-     (defined(LIBRESSL_VERSION_NUMBER) && \
-      LIBRESSL_VERSION_NUMBER >= 0x3040100fL)) && \
-    !defined(OPENSSL_IS_BORINGSSL)
-  #define HAVE_SSL_CTX_SET_CIPHERSUITES
-  #if !defined(OPENSSL_IS_AWSLC)
-    #define HAVE_SSL_CTX_SET_POST_HANDSHAKE_AUTH
-  #endif
-#endif
-
+//#if ((OPENSSL_VERSION_NUMBER >= 0x10101000L && \
+//      !defined(LIBRESSL_VERSION_NUMBER)) || \
+//     (defined(LIBRESSL_VERSION_NUMBER) && \
+//      LIBRESSL_VERSION_NUMBER >= 0x3040100fL)) && \
+//    !defined(OPENSSL_IS_BORINGSSL)
+//  #define HAVE_SSL_CTX_SET_CIPHERSUITES
+//  #if !defined(OPENSSL_IS_AWSLC)
+//    #define HAVE_SSL_CTX_SET_POST_HANDSHAKE_AUTH
+//  #endif
+//#endif
+#define HAVE_SSL_CTX_SET_CIPHERSUITES
 /*
  * Whether SSL_CTX_set1_curves_list is available.
  * OpenSSL: supported since 1.0.2, see
@@ -3437,6 +3437,32 @@ CURLcode Curl_ssl_setup_x509_store(struct Curl_cfilter *cf,
 }
 #endif /* HAVE_SSL_X509_STORE_SHARE */
 
+#include "brotli/decode.h"
+int DecompressBrotliCert(SSL* ssl,
+    CRYPTO_BUFFER** out,
+    size_t uncompressed_len,
+    const uint8_t* in,
+    size_t in_len) {
+    uint8_t* data;
+    /*bssl::UniquePtr<CRYPTO_BUFFER> decompressed(
+        CRYPTO_BUFFER_alloc(&data, uncompressed_len));*/
+
+    CRYPTO_BUFFER* decompressed = CRYPTO_BUFFER_alloc(&data, uncompressed_len);
+    if (!decompressed) {
+        return 0;
+    }
+
+    size_t output_size = uncompressed_len;
+    if (BrotliDecoderDecompress(in_len, in, &output_size, data) !=
+        BROTLI_DECODER_RESULT_SUCCESS ||
+        output_size != uncompressed_len) {
+        return 0;
+    }
+
+    *out = decompressed;
+    return 1;
+};
+
 static CURLcode ossl_connect_step1(struct Curl_cfilter *cf,
                                    struct Curl_easy *data)
 {
@@ -3514,7 +3540,9 @@ static CURLcode ossl_connect_step1(struct Curl_cfilter *cf,
     ossl_close(cf, data);
   }
   backend->ctx = SSL_CTX_new(req_method);
-
+  SSL_CTX_add_cert_compression_alg(backend->ctx, TLSEXT_cert_compression_brotli,
+      NULL /* compression not supported */,
+      DecompressBrotliCert);
   if(!backend->ctx) {
     failf(data, "SSL: couldn't create a context: %s",
           ossl_strerror(ERR_peek_error(), error_buffer, sizeof(error_buffer)));
@@ -3532,7 +3560,7 @@ static CURLcode ossl_connect_step1(struct Curl_cfilter *cf,
     SSL_CTX_set_msg_callback_arg(backend->ctx, cf);
   }
 #endif
-
+  
   /* OpenSSL contains code to work around lots of bugs and flaws in various
      SSL-implementations. SSL_CTX_set_options() is used to enabled those
      work-arounds. The man page for this option states that SSL_OP_ALL enables
@@ -3571,9 +3599,9 @@ static CURLcode ossl_connect_step1(struct Curl_cfilter *cf,
 
   ctx_options = SSL_OP_ALL;
 
-#ifdef SSL_OP_NO_TICKET
-  ctx_options |= SSL_OP_NO_TICKET;
-#endif
+//#ifdef SSL_OP_NO_TICKET
+//  ctx_options |= SSL_OP_NO_TICKET;
+//#endif
 
 #ifdef SSL_OP_NO_COMPRESSION
   ctx_options |= SSL_OP_NO_COMPRESSION;
@@ -3621,6 +3649,13 @@ static CURLcode ossl_connect_step1(struct Curl_cfilter *cf,
     failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION");
     return CURLE_SSL_CONNECT_ERROR;
   }
+  if (ssl_config->primary.extension_permutation) {
+      if (!SSL_CTX_set_extension_permutation(backend->ctx, ssl_config->primary.extension_permutation)) {
+          failf(data, "failed setting extension_permutation");
+          return CURLE_SSL_CIPHER;
+      }
+      infof(data, "TLS extension_permutation is set");
+  }
 
   SSL_CTX_set_options(backend->ctx, ctx_options);
 
diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
index 494b660a9..5ad277a9a 100644
--- a/lib/vtls/vtls.c
+++ b/lib/vtls/vtls.c
@@ -210,6 +210,7 @@ Curl_clone_primary_ssl_config(struct ssl_primary_config *source,
   CLONE_STRING(clientcert);
   CLONE_STRING(cipher_list);
   CLONE_STRING(cipher_list13);
+  CLONE_STRING(extension_permutation);
   CLONE_STRING(pinned_key);
   CLONE_STRING(curves);
   CLONE_STRING(CRLfile);
@@ -229,6 +230,7 @@ void Curl_free_primary_ssl_config(struct ssl_primary_config *sslc)
   Curl_safefree(sslc->clientcert);
   Curl_safefree(sslc->cipher_list);
   Curl_safefree(sslc->cipher_list13);
+  Curl_safefree(sslc->extension_permutation);
   Curl_safefree(sslc->pinned_key);
   Curl_safefree(sslc->cert_blob);
   Curl_safefree(sslc->ca_info_blob);
diff --git a/lib/ws.c b/lib/ws.c
index 3c1964b86..54f95351f 100644
--- a/lib/ws.c
+++ b/lib/ws.c
@@ -540,12 +540,22 @@ CURLcode Curl_ws_request(struct Curl_easy *data, REQTYPE *req)
   size_t randlen;
   char keyval[40];
   struct SingleRequest *k = &data->req;
+
   struct wsfield heads[]= {
+    {
+      "Connection:", "Upgrade"
+    },
+    {
+      "User-Agent:", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
+    },
     {
       /* The request MUST contain an |Upgrade| header field whose value
          MUST include the "websocket" keyword. */
       "Upgrade:", "websocket"
     },
+    {
+      "Origin:", "null"
+    },
     {
       /* The request MUST contain a |Connection| header field whose value
          MUST include the "Upgrade" token. */
@@ -557,6 +567,15 @@ CURLcode Curl_ws_request(struct Curl_easy *data, REQTYPE *req)
          13. */
       "Sec-WebSocket-Version:", "13",
     },
+    {
+      "Accept-Encoding:", "gzip, deflate"
+    },
+    {
+      "Accept-Language:", "zh-CN,zh;q=0.9"
+    },
+    {
+      "Cookie:", ""
+    },
     {
       /* The request MUST include a header field with the name
          |Sec-WebSocket-Key|. The value of this header field MUST be a nonce
@@ -564,10 +583,53 @@ CURLcode Curl_ws_request(struct Curl_easy *data, REQTYPE *req)
          base64-encoded (see Section 4 of [RFC4648]). The nonce MUST be
          selected randomly for each connection. */
       "Sec-WebSocket-Key:", NULL,
-    }
+    },
+    {
+      "Sec-WebSocket-Extensions:", "permessage-deflate; client_max_window_bits"
+    },
+    {
+      "Sec-WebSocket-Protocol:", ""
+    },
   };
-  heads[3].val = &keyval[0];
-
+  heads[9].val = &keyval[0];
+  
+  struct curl_slist* headers = data->set.headers;
+  char head_useragent[512];
+  char head_origin[512];
+  char head_cookie[512];
+  char head_protocol[512];
+  memset(head_protocol, 0, 512);
+  while (headers && headers->data) {
+      size_t len = strlen(headers->data);
+      const char* chr = NULL;
+      if (chr = strstr(headers->data, "User-Agent: "))
+      {
+          strncpy(head_useragent, chr + 12, len - 12);
+          head_useragent[len - 12] = '\0';
+          heads[1].val = &head_useragent[0];
+      } else if (chr = strstr(headers->data, "Origin: "))
+      {
+          strncpy(head_origin, chr + 8, len - 8);
+          head_origin[len - 8] = '\0';
+
+          heads[3].val = &head_origin[0];
+      }
+      else if (chr = strstr(headers->data, "Cookie: "))
+      {
+          strncpy(head_cookie, chr + 8, len - 8);
+          head_cookie[len - 8] = '\0';
+          heads[8].val = &head_cookie[0];
+      }
+      else if (chr = strstr(headers->data, "Sec-WebSocket-Protocol: "))
+      {
+          strncpy(head_protocol, chr + 24, len - 24);
+          head_protocol[len - 24] = '\0';
+          heads[11].val = &head_protocol[0];
+      }
+      headers = headers->next;
+  }
+  size_t use_size = head_protocol[0] != 0 ? sizeof(heads)/sizeof(heads[0]) : ((sizeof(heads)/sizeof(heads[0])) - 1);
+  data->set.headers = NULL;
   /* 16 bytes random */
   result = Curl_rand(data, (unsigned char *)rand, sizeof(rand));
   if(result)
@@ -580,7 +642,7 @@ CURLcode Curl_ws_request(struct Curl_easy *data, REQTYPE *req)
     return CURLE_FAILED_INIT;
   strcpy(keyval, randstr);
   free(randstr);
-  for(i = 0; !result && (i < sizeof(heads)/sizeof(heads[0])); i++) {
+  for(i = 0; !result && (i < use_size); i++) {
     if(!Curl_checkheaders(data, STRCONST(heads[i].name))) {
 #ifdef USE_HYPER
       char field[128];