remove ssl_primary config from easy handle

[icing]

The easy handle owned 2 struct ssl_primary_config when curl is built with proxy support. These structs were basically only used during connection matching and, for a new connection, cloned into the connectdata struct.

Remove these from the easy handle and keep them in the url connection matcher on the stack.

Removal also found several places in TLS backends where the struct from the easy handle was used wrongly instead of the connection's version.

This should shrink the easy handle by another 300+ bytes.

[Copilot]

🟡 Changes recommended

Schannel proxy verification is unintentionally disabled, and the updated unit test clears the configuration it intends to validate.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Moves TLS connection-matching configuration from easy handles to temporary matcher state, reducing handle size and ensuring backends use connection-specific settings.

Changes:

• Builds and clones TLS configuration during connection matching.
• Updates TLS backends to consume connection-owned configuration.
• Preserves SSH key passphrases independently of the easy handle.

File summaries

File	Description
tests/unit/unit3303.c	Adapts TLS configuration matching tests.
lib/vtls/wolfssl.c	Uses connection TLS settings.
lib/vtls/vtls.c	Validates connection TLS preferences.
lib/vtls/vtls_scache.c	Uses connection settings for session caching.
lib/vtls/vtls_config.h	Redefines TLS configuration structures and APIs.
lib/vtls/vtls_config.c	Builds, matches, and clones connection TLS settings.
lib/vtls/schannel.c	Uses connection revocation settings.
lib/vtls/schannel_verify.c	Uses connection verification settings.
lib/vtls/rustls.c	Sources client credentials from the connection.
lib/vtls/openssl.c	Sources TLS options and credentials from the connection.
lib/vtls/mbedtls.c	Sources certificates and keys from the connection.
lib/vtls/gtls.c	Sources credentials and early-data settings from the connection.
lib/vtls/apple.c	Uses connection revocation settings.
lib/vssh/vssh.c	Copies SSH passphrases into connection state.
lib/vssh/ssh.h	Makes the SSH passphrase connection-owned.
lib/vssh/libssh2.c	Uses and frees the copied passphrase.
lib/vssh/libssh.c	Uses and frees the copied passphrase.
lib/vdns/doh.c	Reads SSL options from the compact easy configuration.
lib/url.c	Creates stack-based matching configuration.
lib/setopt.c	Stores TLS options directly in easy configuration.
lib/ldap.c	Uses connection certificate type.

Review details

• Files reviewed: 21/21 changed files
• Comments generated: 4
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.