curb 0.8.5 → 1.3.6

data/ext/curb_easy.c

@@ -11,13 +11,36 @@
 #include "curb_multi.h"
 
 #include <errno.h>
+#include <stdlib.h>
 #include <string.h>
+#ifndef _WIN32
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#else
+#include <winsock2.h>
+#include <ws2tcpip.h>
+#endif
+#ifndef _WIN32
+#include <strings.h>
+#endif
+
+#if defined(HAVE_CURLOPT_OPENSOCKETFUNCTION) && defined(HAVE_CURLOPT_OPENSOCKETDATA)
+#define CURB_HAVE_OPENSOCKET_NETWORK_POLICY 1
+#endif
+
+#if defined(HAVE_CURLOPT_PREREQFUNCTION) && defined(HAVE_CURLOPT_PREREQDATA)
+#define CURB_HAVE_PREREQ_HOST_POLICY 1
+#endif
 
 extern VALUE mCurl;
 
 static VALUE idCall;
 static VALUE idJoin;
 static VALUE rbstrAmp;
+static ID idNetworkPolicyNone;
+static ID idNetworkPolicyPublic;
 
 #ifdef RDOC_NEVER_DEFINED
   mCurl = rb_define_module("Curl");
@@ -25,20 +48,859 @@ static VALUE rbstrAmp;
 
 VALUE cCurlEasy;
 
+/* Internal wrapper type for passing pointers through rb_iterate callbacks.
+ * No mark/free needed - these are temporary wrappers that don't own memory. */
+static const rb_data_type_t curl_slist_ptr_type = {
+  "curl_slist_ptr_wrapper",
+  { NULL, NULL, NULL },
+  NULL, NULL, 0
+};
+
+// for Ruby 1.8
+#ifndef HAVE_RB_IO_STDIO_FILE
+static FILE * rb_io_stdio_file(rb_io_t *fptr) {
+  return fptr->f;
+}
+#endif
+static struct curl_slist *duplicate_curl_slist(struct curl_slist *list);
+static size_t proc_data_handler(char *stream, size_t size, size_t nmemb, VALUE proc);
+static int curb_array_includes_string(VALUE list, VALUE value);
 
 /* ================== CURL HANDLER FUNCS ==============*/
 
-static VALUE callback_exception(VALUE unused) {
+static int curb_ipv4_is_unsafe_destination(const unsigned char *ip) {
+  if (ip[0] == 0) return 1;                                /* 0.0.0.0/8 */
+  if (ip[0] == 10) return 1;                               /* RFC1918 */
+  if (ip[0] == 100 && (ip[1] & 0xc0) == 0x40) return 1;    /* 100.64.0.0/10 */
+  if (ip[0] == 100 && ip[1] == 100 && ip[2] == 100 && ip[3] == 200) return 1;
+  if (ip[0] == 127) return 1;                              /* loopback */
+  if (ip[0] == 169 && ip[1] == 254) return 1;              /* link-local / metadata */
+  if (ip[0] == 172 && ip[1] >= 16 && ip[1] <= 31) return 1;/* RFC1918 */
+  if (ip[0] == 192 && ip[1] == 168) return 1;              /* RFC1918 */
+  if (ip[0] == 192 && ip[1] == 0 && ip[2] == 0) return 1;  /* IETF protocol assignments */
+  if (ip[0] == 192 && ip[1] == 0 && ip[2] == 2) return 1;  /* TEST-NET-1 */
+  if (ip[0] == 198 && (ip[1] == 18 || ip[1] == 19)) return 1;
+  if (ip[0] == 198 && ip[1] == 51 && ip[2] == 100) return 1;
+  if (ip[0] == 203 && ip[1] == 0 && ip[2] == 113) return 1;
+  if (ip[0] >= 224) return 1;                              /* multicast/reserved */
+
+  return 0;
+}
+
+static int curb_ip_prefix_matches(const unsigned char *ip, const unsigned char *prefix, int bits) {
+  int full_bytes = bits / 8;
+  int remaining_bits = bits % 8;
+  int i;
+
+  for (i = 0; i < full_bytes; i++) {
+    if (ip[i] != prefix[i]) return 0;
+  }
+
+  if (remaining_bits) {
+    unsigned char mask = (unsigned char)(0xff << (8 - remaining_bits));
+    if ((ip[full_bytes] & mask) != (prefix[full_bytes] & mask)) return 0;
+  }
+
+  return 1;
+}
+
+static int curb_ipv6_prefix_matches(const unsigned char *ip, const unsigned char *prefix, int bits) {
+  return curb_ip_prefix_matches(ip, prefix, bits);
+}
+
+static int curb_ipv6_is_all_zero(const unsigned char *ip) {
+  int i;
+
+  for (i = 0; i < 16; i++) {
+    if (ip[i] != 0) return 0;
+  }
+
+  return 1;
+}
+
+static int curb_ipv6_is_ipv4_mapped(const unsigned char *ip) {
+  static const unsigned char prefix[12] = {
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xff, 0xff
+  };
+
+  return curb_ipv6_prefix_matches(ip, prefix, 96);
+}
+
+static int curb_ipv6_is_ipv4_compatible(const unsigned char *ip) {
+  static const unsigned char prefix[12] = {
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
+  };
+
+  return curb_ipv6_prefix_matches(ip, prefix, 96);
+}
+
+static int curb_ipv6_is_nat64_well_known(const unsigned char *ip) {
+  static const unsigned char prefix[12] = {
+    0x00, 0x64, 0xff, 0x9b, 0, 0, 0, 0, 0, 0, 0, 0
+  };
+
+  return curb_ipv6_prefix_matches(ip, prefix, 96);
+}
+
+static int curb_ipv6_is_nat64_local_use(const unsigned char *ip) {
+  static const unsigned char prefix[6] = {
+    0x00, 0x64, 0xff, 0x9b, 0x00, 0x01
+  };
+
+  return curb_ipv6_prefix_matches(ip, prefix, 48);
+}
+
+static int curb_ipv6_is_unsafe_destination(const unsigned char *ip) {
+  static const unsigned char documentation_prefix[4] = { 0x20, 0x01, 0x0d, 0xb8 };
+  static const unsigned char benchmarking_prefix[6] = { 0x20, 0x01, 0x00, 0x02, 0, 0 };
+
+  if (curb_ipv6_is_all_zero(ip)) return 1;                 /* ::/128 */
+  if (curb_ipv6_is_ipv4_mapped(ip)) return curb_ipv4_is_unsafe_destination(ip + 12);
+  if (curb_ipv6_is_nat64_well_known(ip)) return curb_ipv4_is_unsafe_destination(ip + 12);
+  if (curb_ipv6_is_nat64_local_use(ip)) return 1;
+  if (curb_ipv6_is_ipv4_compatible(ip)) return 1;          /* deprecated non-public space */
+  if (ip[0] == 0 && ip[1] == 0 && ip[14] == 0 && ip[15] == 1) return 1;
+  if ((ip[0] & 0xfe) == 0xfc) return 1;                    /* fc00::/7 */
+  if (ip[0] == 0xfe && (ip[1] & 0xc0) == 0x80) return 1;   /* fe80::/10 */
+  if (ip[0] == 0xfe && (ip[1] & 0xc0) == 0xc0) return 1;   /* fec0::/10 */
+  if (ip[0] == 0xff) return 1;                             /* multicast */
+  if (curb_ipv6_prefix_matches(ip, documentation_prefix, 32)) return 1;
+  if (curb_ipv6_prefix_matches(ip, benchmarking_prefix, 48)) return 1;
+  if (ip[0] == 0x20 && ip[1] == 0x02) return 1;            /* 2002::/16 */
+
+  return 0;
+}
+
+static void curb_clear_network_allowed_cidr_rules(ruby_curl_easy *rbce) {
+  if (!rbce || !rbce->network_allowed_cidr_rules) return;
+
+  xfree(rbce->network_allowed_cidr_rules);
+  rbce->network_allowed_cidr_rules = NULL;
+  rbce->network_allowed_cidr_rule_count = 0;
+}
+
+static void curb_raise_invalid_cidr(char *tmp, const char *cidr) {
+  if (tmp) xfree(tmp);
+  rb_raise(rb_eArgError, "invalid CIDR range: %s", cidr);
+}
+
+static void curb_parse_cidr_rule(const char *cidr, curb_cidr_rule *rule) {
+  size_t len;
+  char *tmp;
+  char *address;
+  char *prefix_str = NULL;
+  char *slash;
+  long prefix = -1;
+  int max_prefix = 0;
+  unsigned char parsed[16];
+
+  if (!cidr || !rule) {
+    rb_raise(rb_eArgError, "invalid CIDR range");
+  }
+
+  len = strlen(cidr);
+  if (len == 0) {
+    rb_raise(rb_eArgError, "invalid CIDR range: %s", cidr);
+  }
+
+  tmp = ALLOC_N(char, len + 1);
+  memcpy(tmp, cidr, len + 1);
+  address = tmp;
+
+  if (address[0] == '[') {
+    char *closing = strchr(address, ']');
+    if (!closing) curb_raise_invalid_cidr(tmp, cidr);
+
+    *closing = '\0';
+    address++;
+
+    if (closing[1] == '/') {
+      prefix_str = closing + 2;
+    } else if (closing[1] != '\0') {
+      curb_raise_invalid_cidr(tmp, cidr);
+    }
+  } else {
+    slash = strchr(address, '/');
+    if (slash) {
+      *slash = '\0';
+      prefix_str = slash + 1;
+    }
+  }
+
+  memset(rule, 0, sizeof(curb_cidr_rule));
+
+  if (inet_pton(AF_INET, address, parsed) == 1) {
+    rule->family = CURB_CIDR_FAMILY_IPV4;
+    max_prefix = 32;
+    memcpy(rule->address, parsed, 4);
+  } else if (inet_pton(AF_INET6, address, parsed) == 1) {
+    rule->family = CURB_CIDR_FAMILY_IPV6;
+    max_prefix = 128;
+    memcpy(rule->address, parsed, 16);
+  } else {
+    curb_raise_invalid_cidr(tmp, cidr);
+  }
+
+  if (prefix_str) {
+    char *endptr = NULL;
+
+    if (prefix_str[0] == '\0') curb_raise_invalid_cidr(tmp, cidr);
+
+    errno = 0;
+    prefix = strtol(prefix_str, &endptr, 10);
+    if (errno != 0 || !endptr || *endptr != '\0' || prefix < 0 || prefix > max_prefix) {
+      curb_raise_invalid_cidr(tmp, cidr);
+    }
+  } else {
+    prefix = max_prefix;
+  }
+
+  rule->prefix_bits = (unsigned char)prefix;
+  xfree(tmp);
+}
+
+static VALUE curb_normalize_cidr_list(VALUE cidrs) {
+  VALUE list;
+  VALUE normalized;
+  long i;
+
+  if (NIL_P(cidrs)) return Qnil;
+
+  list = rb_check_array_type(cidrs);
+  if (NIL_P(list)) {
+    list = rb_ary_new_from_args(1, cidrs);
+  }
+
+  normalized = rb_ary_new_capa(RARRAY_LEN(list));
+  for (i = 0; i < RARRAY_LEN(list); i++) {
+    VALUE item = rb_ary_entry(list, i);
+    VALUE cidr = rb_obj_as_string(item);
+    curb_cidr_rule unused_rule;
+
+    curb_parse_cidr_rule(StringValueCStr(cidr), &unused_rule);
+    if (!curb_array_includes_string(normalized, cidr)) {
+      rb_ary_push(normalized, rb_str_dup(cidr));
+    }
+  }
+
+  return normalized;
+}
+
+static VALUE curb_dup_string_array(VALUE list) {
+  VALUE copy;
+  long i;
+
+  if (NIL_P(list)) return Qnil;
+
+  copy = rb_ary_new_capa(RARRAY_LEN(list));
+  for (i = 0; i < RARRAY_LEN(list); i++) {
+    rb_ary_push(copy, rb_str_dup(rb_ary_entry(list, i)));
+  }
+
+  return copy;
+}
+
+static int curb_array_includes_string(VALUE list, VALUE value) {
+  long i;
+
+  for (i = 0; i < RARRAY_LEN(list); i++) {
+    if (rb_str_cmp(rb_ary_entry(list, i), value) == 0) return 1;
+  }
+
+  return 0;
+}
+
+static char curb_ascii_downcase(char c) {
+  if (c >= 'A' && c <= 'Z') return (char)(c - 'A' + 'a');
+  return c;
+}
+
+static char *curb_normalized_host_from_range(const char *start, const char *end, int raise_errors) {
+  char *host;
+  size_t len;
+  size_t i;
+
+  while (start < end && (*start == ' ' || *start == '\t' || *start == '\r' || *start == '\n')) start++;
+  while (end > start && (end[-1] == ' ' || end[-1] == '\t' || end[-1] == '\r' || end[-1] == '\n')) end--;
+  while (end > start && end[-1] == '.') end--;
+
+  if (end <= start) {
+    if (!raise_errors) return NULL;
+    rb_raise(rb_eArgError, "allowed_hosts cannot include blank entries");
+  }
+
+  len = (size_t)(end - start);
+  host = ALLOC_N(char, len + 1);
+  for (i = 0; i < len; i++) {
+    host[i] = curb_ascii_downcase(start[i]);
+  }
+  host[len] = '\0';
+
+  return host;
+}
+
+static char *curb_normalize_host_value_impl(const char *value, int raise_errors) {
+  const char *start;
+  const char *end;
+  const char *scheme;
+  const char *authority_end;
+  const char *scan;
+  const char *last_at = NULL;
+  int colon_count = 0;
+
+  if (!value) {
+    if (!raise_errors) return NULL;
+    rb_raise(rb_eArgError, "allowed_hosts cannot include blank entries");
+  }
+
+  start = value;
+  end = value + strlen(value);
+  while (start < end && (*start == ' ' || *start == '\t' || *start == '\r' || *start == '\n')) start++;
+  while (end > start && (end[-1] == ' ' || end[-1] == '\t' || end[-1] == '\r' || end[-1] == '\n')) end--;
+  if (end <= start) {
+    if (!raise_errors) return NULL;
+    rb_raise(rb_eArgError, "allowed_hosts cannot include blank entries");
+  }
+
+  scheme = strstr(start, "://");
+  if (scheme && scheme < end) {
+    start = scheme + 3;
+  }
+
+  authority_end = end;
+  for (scan = start; scan < end; scan++) {
+    if (*scan == '/' || *scan == '?' || *scan == '#') {
+      authority_end = scan;
+      break;
+    }
+  }
+
+  for (scan = start; scan < authority_end; scan++) {
+    if (*scan == '@') last_at = scan;
+  }
+  if (last_at) start = last_at + 1;
+
+  if (start < authority_end && *start == '[') {
+    const char *closing = start + 1;
+    while (closing < authority_end && *closing != ']') closing++;
+    if (closing >= authority_end) {
+      if (!raise_errors) return NULL;
+      rb_raise(rb_eArgError, "invalid allowed host: %s", value);
+    }
+    return curb_normalized_host_from_range(start + 1, closing, raise_errors);
+  }
+
+  for (scan = start; scan < authority_end; scan++) {
+    if (*scan == ':') colon_count++;
+  }
+
+  if (colon_count <= 1) {
+    for (scan = start; scan < authority_end; scan++) {
+      if (*scan == ':') {
+        authority_end = scan;
+        break;
+      }
+    }
+  }
+
+  return curb_normalized_host_from_range(start, authority_end, raise_errors);
+}
+
+static char *curb_normalize_host_value(const char *value) {
+  return curb_normalize_host_value_impl(value, 1);
+}
+
+static char *curb_try_normalize_host_value(const char *value) {
+  return curb_normalize_host_value_impl(value, 0);
+}
+
+static VALUE curb_normalize_host_list(VALUE hosts) {
+  VALUE list;
+  VALUE normalized;
+  long i;
+
+  if (NIL_P(hosts)) return Qnil;
+
+  list = rb_check_array_type(hosts);
+  if (NIL_P(list)) {
+    list = rb_ary_new_from_args(1, hosts);
+  }
+
+  normalized = rb_ary_new_capa(RARRAY_LEN(list));
+  for (i = 0; i < RARRAY_LEN(list); i++) {
+    VALUE item = rb_ary_entry(list, i);
+    VALUE host_value = rb_obj_as_string(item);
+    char *host = curb_normalize_host_value(StringValueCStr(host_value));
+    VALUE normalized_host = rb_str_new_cstr(host);
+
+    if (!curb_array_includes_string(normalized, normalized_host)) {
+      rb_ary_push(normalized, normalized_host);
+    }
+    xfree(host);
+  }
+
+  return normalized;
+}
+
+static void curb_clear_network_allowed_hosts(ruby_curl_easy *rbce) {
+  size_t i;
+
+  if (!rbce || !rbce->network_allowed_hosts) return;
+
+  for (i = 0; i < rbce->network_allowed_host_count; i++) {
+    if (rbce->network_allowed_hosts[i]) xfree(rbce->network_allowed_hosts[i]);
+  }
+  xfree(rbce->network_allowed_hosts);
+  rbce->network_allowed_hosts = NULL;
+  rbce->network_allowed_host_count = 0;
+}
+
+static char *curb_strdup_cstr(const char *value) {
+  size_t len = strlen(value);
+  char *copy = ALLOC_N(char, len + 1);
+  memcpy(copy, value, len + 1);
+  return copy;
+}
+
+static void curb_prepare_network_allowed_hosts(ruby_curl_easy *rbce) {
+  VALUE hosts;
+  long count;
+  long i;
+  char **rules;
+
+  if (!rbce) return;
+
+  curb_clear_network_allowed_hosts(rbce);
+
+  hosts = rb_hash_aref(rbce->opts, rb_easy_hkey("allowed_hosts"));
+  if (NIL_P(hosts)) return;
+
+  count = RARRAY_LEN(hosts);
+  if (count <= 0) return;
+
+  rules = ALLOC_N(char *, count);
+  for (i = 0; i < count; i++) {
+    VALUE host = rb_ary_entry(hosts, i);
+    rules[i] = curb_strdup_cstr(StringValueCStr(host));
+  }
+
+  rbce->network_allowed_hosts = rules;
+  rbce->network_allowed_host_count = (size_t)count;
+}
+
+static int curb_host_rules_match(const ruby_curl_easy *rbce, const char *host) {
+  size_t i;
+
+  if (!rbce || rbce->network_allowed_host_count == 0) return 1;
+
+  for (i = 0; i < rbce->network_allowed_host_count; i++) {
+    if (strcmp(host, rbce->network_allowed_hosts[i]) == 0) return 1;
+  }
+
+  return 0;
+}
+
+static void curb_prepare_network_allowed_cidr_rules(ruby_curl_easy *rbce) {
+  VALUE cidrs;
+  long count;
+  long i;
+  curb_cidr_rule *rules;
+
+  if (!rbce) return;
+
+  curb_clear_network_allowed_cidr_rules(rbce);
+
+  cidrs = rb_hash_aref(rbce->opts, rb_easy_hkey("allowed_cidrs"));
+  if (NIL_P(cidrs)) return;
+
+  count = RARRAY_LEN(cidrs);
+  if (count <= 0) return;
+
+  rules = ALLOC_N(curb_cidr_rule, count);
+  for (i = 0; i < count; i++) {
+    VALUE cidr = rb_ary_entry(cidrs, i);
+    curb_parse_cidr_rule(StringValueCStr(cidr), &rules[i]);
+  }
+
+  rbce->network_allowed_cidr_rules = rules;
+  rbce->network_allowed_cidr_rule_count = (size_t)count;
+}
+
+static int curb_cidr_rules_match(const ruby_curl_easy *rbce, unsigned char family, const unsigned char *ip) {
+  size_t i;
+
+  if (!rbce || rbce->network_allowed_cidr_rule_count == 0) return 1;
+
+  for (i = 0; i < rbce->network_allowed_cidr_rule_count; i++) {
+    const curb_cidr_rule *rule = &rbce->network_allowed_cidr_rules[i];
+    if (rule->family != family) continue;
+    if (curb_ip_prefix_matches(ip, rule->address, rule->prefix_bits)) return 1;
+  }
+
+  return 0;
+}
+
+static void curb_format_ipv4(char *buf, size_t len, const unsigned char *ip) {
+  snprintf(buf, len, "%u.%u.%u.%u",
+           (unsigned int)ip[0], (unsigned int)ip[1],
+           (unsigned int)ip[2], (unsigned int)ip[3]);
+}
+
+static void curb_format_ipv6(char *buf, size_t len, const unsigned char *ip) {
+#ifdef AF_INET6
+#ifdef _WIN32
+  if (inet_ntop(AF_INET6, (void *)ip, buf, len)) return;
+#else
+  if (inet_ntop(AF_INET6, (const void *)ip, buf, (socklen_t)len)) return;
+#endif
+#endif
+
+  snprintf(buf, len,
+           "%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x",
+           (unsigned int)ip[0], (unsigned int)ip[1],
+           (unsigned int)ip[2], (unsigned int)ip[3],
+           (unsigned int)ip[4], (unsigned int)ip[5],
+           (unsigned int)ip[6], (unsigned int)ip[7],
+           (unsigned int)ip[8], (unsigned int)ip[9],
+           (unsigned int)ip[10], (unsigned int)ip[11],
+           (unsigned int)ip[12], (unsigned int)ip[13],
+           (unsigned int)ip[14], (unsigned int)ip[15]);
+}
+
+static void curb_store_destination_error(ruby_curl_easy *rbce, const char *address, const char *reason) {
+  if (!rbce) return;
+
+  rbce->unsafe_destination_blocked = 1;
+
+  if (reason && reason[0]) {
+    snprintf(rbce->unsafe_destination_error, CURL_ERROR_SIZE,
+             "blocked destination address %s %s by public network policy", address, reason);
+  } else {
+    snprintf(rbce->unsafe_destination_error, CURL_ERROR_SIZE,
+             "blocked unsafe destination address %s by public network policy", address);
+  }
+
+  snprintf(rbce->err_buf, CURL_ERROR_SIZE, "%s", rbce->unsafe_destination_error);
+}
+
+static void curb_store_unsafe_destination_error(ruby_curl_easy *rbce, const char *address) {
+  curb_store_destination_error(rbce, address, NULL);
+}
+
+static void curb_store_host_allowlist_error(ruby_curl_easy *rbce, const char *host) {
+  if (!rbce) return;
+
+  rbce->unsafe_destination_blocked = 1;
+  snprintf(rbce->unsafe_destination_error, CURL_ERROR_SIZE,
+           "blocked URL host %s by safe mode host allowlist", host ? host : "unknown");
+  snprintf(rbce->err_buf, CURL_ERROR_SIZE, "%s", rbce->unsafe_destination_error);
+}
+
+#ifdef CURB_HAVE_PREREQ_HOST_POLICY
+static int curb_host_allowlist_prereq(void *clientp,
+                                      char *conn_primary_ip,
+                                      char *conn_local_ip,
+                                      int conn_primary_port,
+                                      int conn_local_port) {
+  ruby_curl_easy *rbce = (ruby_curl_easy *)clientp;
+  char *effective_url = NULL;
+  char *host = NULL;
+  CURLcode rc;
+
+  (void)conn_primary_ip;
+  (void)conn_local_ip;
+  (void)conn_primary_port;
+  (void)conn_local_port;
+
+  if (!rbce || rbce->network_allowed_host_count == 0) {
+    return CURL_PREREQFUNC_OK;
+  }
+
+  rc = curl_easy_getinfo(rbce->curl, CURLINFO_EFFECTIVE_URL, &effective_url);
+  if (rc != CURLE_OK || !effective_url) {
+    curb_store_host_allowlist_error(rbce, "unknown");
+    return CURL_PREREQFUNC_ABORT;
+  }
+
+  host = curb_try_normalize_host_value(effective_url);
+  if (!host) {
+    curb_store_host_allowlist_error(rbce, "unknown");
+    return CURL_PREREQFUNC_ABORT;
+  }
+
+  if (!curb_host_rules_match(rbce, host)) {
+    curb_store_host_allowlist_error(rbce, host);
+    xfree(host);
+    return CURL_PREREQFUNC_ABORT;
+  }
+
+  xfree(host);
+  return CURL_PREREQFUNC_OK;
+}
+#endif
+
+#ifdef CURB_HAVE_OPENSOCKET_NETWORK_POLICY
+static curl_socket_t curb_public_network_opensocket(void *clientp, curlsocktype purpose, struct curl_sockaddr *address) {
+  ruby_curl_easy *rbce = (ruby_curl_easy *)clientp;
+  curl_socket_t sockfd;
+  char address_string[80];
+  int checked_destination_address = 0;
+
+  (void)purpose;
+
+  if (!address) {
+    curb_store_unsafe_destination_error(rbce, "unknown");
+    return CURL_SOCKET_BAD;
+  }
+
+#ifdef AF_INET
+  if (address->family == AF_INET && address->addrlen >= sizeof(struct sockaddr_in)) {
+    const struct sockaddr_in *sin = (const struct sockaddr_in *)&address->addr;
+    const unsigned char *ip = (const unsigned char *)&sin->sin_addr;
+    checked_destination_address = 1;
+
+    if (curb_ipv4_is_unsafe_destination(ip)) {
+      curb_format_ipv4(address_string, sizeof(address_string), ip);
+      curb_store_unsafe_destination_error(rbce, address_string);
+      return CURL_SOCKET_BAD;
+    }
+
+    if (!curb_cidr_rules_match(rbce, CURB_CIDR_FAMILY_IPV4, ip)) {
+      curb_format_ipv4(address_string, sizeof(address_string), ip);
+      curb_store_destination_error(rbce, address_string, "outside allowed CIDR ranges");
+      return CURL_SOCKET_BAD;
+    }
+  }
+#endif
+
+#ifdef AF_INET6
+  if (address->family == AF_INET6 && address->addrlen >= sizeof(struct sockaddr_in6)) {
+    const struct sockaddr_in6 *sin6 = (const struct sockaddr_in6 *)&address->addr;
+    const unsigned char *ip = (const unsigned char *)&sin6->sin6_addr;
+    checked_destination_address = 1;
+
+    if (curb_ipv6_is_unsafe_destination(ip)) {
+      curb_format_ipv6(address_string, sizeof(address_string), ip);
+      curb_store_unsafe_destination_error(rbce, address_string);
+      return CURL_SOCKET_BAD;
+    }
+
+    if (!curb_cidr_rules_match(rbce, CURB_CIDR_FAMILY_IPV6, ip)) {
+      curb_format_ipv6(address_string, sizeof(address_string), ip);
+      curb_store_destination_error(rbce, address_string, "outside allowed CIDR ranges");
+      return CURL_SOCKET_BAD;
+    }
+  }
+#endif
+
+  if (!checked_destination_address && rbce && rbce->network_allowed_cidr_rule_count > 0) {
+    curb_store_destination_error(rbce, "unknown", "outside allowed CIDR ranges");
+    return CURL_SOCKET_BAD;
+  }
+
+  sockfd = socket(address->family, address->socktype, address->protocol);
+  if (sockfd == CURL_SOCKET_BAD) {
+    return CURL_SOCKET_BAD;
+  }
+
+  return sockfd;
+}
+#endif
+
+static VALUE callback_exception(VALUE unused, VALUE exception) {
   return Qfalse;
-} 
+}
 
-/* These handle both body and header data */
-static size_t default_data_handler(char *stream,
+static VALUE callback_exception_store_on_easy(VALUE arg, VALUE exception) {
+  ruby_curl_easy *rbce = (ruby_curl_easy *)arg;
+
+  if (rbce && NIL_P(rbce->callback_error)) {
+    rbce->callback_error = exception;
+  }
+
+  return Qfalse;
+}
+
+VALUE rb_curl_easy_take_callback_error(ruby_curl_easy *rbce) {
+  VALUE exception = Qnil;
+
+  if (!rbce) {
+    return Qnil;
+  }
+
+  exception = rbce->callback_error;
+  rbce->callback_error = Qnil;
+  return exception;
+}
+
+static VALUE ruby_curl_easy_take_callback_error(VALUE self) {
+  ruby_curl_easy *rbce = NULL;
+
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
+  return rb_curl_easy_take_callback_error(rbce);
+}
+
+static VALUE ensure_clear_easy_callback_active(VALUE arg) {
+  ruby_curl_easy *rbce = (ruby_curl_easy *)arg;
+  if (rbce) {
+    rbce->callback_active = 0;
+  }
+  return Qnil;
+}
+
+static VALUE with_easy_callback_active(ruby_curl_easy *rbce, VALUE (*func)(VALUE), VALUE arg) {
+  rbce->callback_active = 1;
+  return rb_ensure(func, arg, ensure_clear_easy_callback_active, (VALUE)rbce);
+}
+
+static void ruby_curl_easy_enter_native(ruby_curl_easy *rbce) {
+  if (rbce) {
+    rbce->native_active++;
+  }
+}
+
+static VALUE ruby_curl_easy_leave_native(VALUE arg) {
+  ruby_curl_easy *rbce = (ruby_curl_easy *)arg;
+  if (rbce && rbce->native_active > 0) {
+    rbce->native_active--;
+  }
+  return Qnil;
+}
+
+struct stream_read_call_args {
+  VALUE stream;
+  size_t read_bytes;
+};
+
+static VALUE call_stream_read(VALUE argp) {
+  struct stream_read_call_args *args = (struct stream_read_call_args *)argp;
+  return rb_funcall(args->stream, rb_intern("read"), 1, ULONG2NUM((unsigned long)args->read_bytes));
+}
+
+static VALUE call_stream_to_s(VALUE stream) {
+  return rb_funcall(stream, rb_intern("to_s"), 0);
+}
+
+static VALUE call_string_value(VALUE str) {
+  StringValue(str);
+  return str;
+}
+
+struct stream_seek_call_args {
+  VALUE stream;
+  curl_off_t offset;
+  int origin;
+};
+
+static VALUE call_stream_seek(VALUE argp) {
+  struct stream_seek_call_args *args = (struct stream_seek_call_args *)argp;
+  return rb_funcall(args->stream, rb_intern("seek"), 2, LL2NUM(args->offset), INT2NUM(args->origin));
+}
+
+struct proc_data_call_args {
+  char *stream;
+  size_t size;
+  size_t nmemb;
+  VALUE proc;
+};
+
+static VALUE call_proc_data_handler_wrapped(VALUE argp) {
+  struct proc_data_call_args *args = (struct proc_data_call_args *)argp;
+  return ULONG2NUM((unsigned long)proc_data_handler(args->stream, args->size, args->nmemb, args->proc));
+}
+
+struct easy_callback_dispatch_args {
+  ruby_curl_easy *rbce;
+  VALUE (*func)(VALUE);
+  VALUE arg;
+};
+
+static VALUE call_with_easy_callback_active(VALUE argp) {
+  struct easy_callback_dispatch_args *args = (struct easy_callback_dispatch_args *)argp;
+  return with_easy_callback_active(args->rbce, args->func, args->arg);
+}
+
+static VALUE rescue_easy_callback(ruby_curl_easy *rbce, VALUE (*func)(VALUE), VALUE arg) {
+  struct easy_callback_dispatch_args dispatch_args;
+  dispatch_args.rbce = rbce;
+  dispatch_args.func = func;
+  dispatch_args.arg = arg;
+  return rb_rescue(call_with_easy_callback_active, (VALUE)&dispatch_args, callback_exception_store_on_easy, (VALUE)rbce);
+}
+
+static size_t curl_read_abort_result(void) {
+#ifdef CURL_READFUNC_ABORT
+  return CURL_READFUNC_ABORT;
+#else
+  return 0;
+#endif
+}
+
+static int curl_seek_fail_result(void) {
+#ifdef CURL_SEEKFUNC_FAIL
+  return CURL_SEEKFUNC_FAIL;
+#else
+  return 1;
+#endif
+}
+
+static int ruby_curl_easy_body_limit_exceeded(ruby_curl_easy *rbce, size_t total) {
+  VALUE max_body_bytes = rb_easy_get("max_body_bytes");
+  curl_off_t limit;
+
+  if (NIL_P(max_body_bytes)) {
+    return 0;
+  }
+
+  limit = (curl_off_t)NUM2LL(max_body_bytes);
+  if (limit <= 0) {
+    return 0;
+  }
+
+  if ((curl_off_t)total > limit - rbce->downloaded_body_bytes) {
+    if (NIL_P(rbce->callback_error)) {
+      rbce->callback_error = rb_exc_new_cstr(eCurlErrFileSizeExceeded, "Maximum body size exceeded");
+    }
+    return 1;
+  }
+
+  rbce->downloaded_body_bytes += (curl_off_t)total;
+  return 0;
+}
+
+/* Default body handler appends to easy.body_data buffer */
+static size_t default_body_handler(char *stream,
                                    size_t size,
                                    size_t nmemb,
-                                   VALUE out) {
-  rb_str_buf_cat(out, stream, size * nmemb);
-  return size * nmemb;
+                                   void *userdata) {
+  ruby_curl_easy *rbce = (ruby_curl_easy *)userdata;
+  size_t total = size * nmemb;
+  VALUE out = rb_easy_get("body_data");
+
+  if (ruby_curl_easy_body_limit_exceeded(rbce, total)) {
+    return 0;
+  }
+
+  if (NIL_P(out)) {
+    out = rb_easy_set("body_data", rb_str_buf_new(32768));
+  }
+  rb_str_buf_cat(out, stream, total);
+  return total;
+}
+
+/* Default header handler appends to easy.header_data buffer */
+static size_t default_header_handler(char *stream,
+                                     size_t size,
+                                     size_t nmemb,
+                                     void *userdata) {
+  ruby_curl_easy *rbce = (ruby_curl_easy *)userdata;
+  size_t total = size * nmemb;
+  VALUE out = rb_easy_get("header_data");
+  if (NIL_P(out)) {
+    out = rb_easy_set("header_data", rb_str_buf_new(16384));
+  }
+  rb_str_buf_cat(out, stream, total);
+  return total;
 }
 
 // size_t function( void *ptr, size_t size, size_t nmemb, void *stream);
@@ -48,14 +910,36 @@ static size_t read_data_handler(void *ptr,
                                 ruby_curl_easy *rbce) {
   VALUE upload = rb_easy_get("upload");
   size_t read_bytes = (size*nmemb);
-  VALUE stream = ruby_curl_upload_stream_get(upload);
+  VALUE stream;
+
+  if (NIL_P(upload)) {
+    return curl_read_abort_result();
+  }
+
+  stream = ruby_curl_upload_stream_get(upload);
 
   if (rb_respond_to(stream, rb_intern("read"))) {//if (rb_respond_to(stream, rb_intern("to_s"))) {
     /* copy read_bytes from stream into ptr */
-    VALUE str = rb_funcall(stream, rb_intern("read"), 1, rb_int_new(read_bytes) );
+    struct stream_read_call_args args;
+    args.stream = stream;
+    args.read_bytes = read_bytes;
+    VALUE str = rescue_easy_callback(rbce, call_stream_read, (VALUE)&args);
     if( str != Qnil ) {
-      memcpy(ptr, RSTRING_PTR(str), RSTRING_LEN(str));
-      return RSTRING_LEN(str);
+      size_t str_len;
+
+      str = rescue_easy_callback(rbce, call_string_value, str);
+      if (str == Qfalse || str == Qnil) {
+        return curl_read_abort_result();
+      }
+
+      str_len = (size_t)RSTRING_LEN(str);
+      if (str_len > read_bytes) {
+        snprintf(rbce->err_buf, CURL_ERROR_SIZE, "read callback returned more data than requested");
+        return curl_read_abort_result();
+      }
+
+      memcpy(ptr, RSTRING_PTR(str), str_len);
+      return str_len;
     }
     else {
       return 0;
@@ -67,13 +951,22 @@ static size_t read_data_handler(void *ptr,
     size_t len;
     size_t remaining;
     char *str_ptr;
-    Data_Get_Struct(upload, ruby_curl_upload, rbcu);
-    str = rb_funcall(stream, rb_intern("to_s"), 0);
+    TypedData_Get_Struct(upload, ruby_curl_upload, &ruby_curl_upload_data_type, rbcu);
+    str = rescue_easy_callback(rbce, call_stream_to_s, stream);
+    str = rescue_easy_callback(rbce, call_string_value, str);
+    if (str == Qfalse || str == Qnil) {
+      return curl_read_abort_result();
+    }
+
     len = RSTRING_LEN(str);
+    if (rbcu->offset >= len) {
+      return 0;
+    }
+
     remaining = len - rbcu->offset;
     str_ptr = RSTRING_PTR(str);
 
-    if( remaining < read_bytes ) {
+    if( remaining <= read_bytes ) {
       if( remaining > 0 ) {
         memcpy(ptr, str_ptr+rbcu->offset, remaining);
         read_bytes = remaining;
@@ -81,14 +974,10 @@ static size_t read_data_handler(void *ptr,
       }
       return remaining;
     }
-    else if( remaining > read_bytes ) { // read_bytes <= remaining - send what we can fit in the buffer(ptr)
+    else { // read_bytes < remaining - send what we can fit in the buffer(ptr)
       memcpy(ptr, str_ptr+rbcu->offset, read_bytes);
       rbcu->offset += read_bytes;
     }
-    else { // they're equal
-      memcpy(ptr, str_ptr+rbcu->offset, --read_bytes);
-      rbcu->offset += read_bytes;
-    }
     return read_bytes;
   }
   else {
@@ -96,6 +985,38 @@ static size_t read_data_handler(void *ptr,
   }
 }
 
+int seek_data_handler(ruby_curl_easy *rbce,
+                      curl_off_t offset,
+                      int origin) {
+
+  VALUE upload = rb_easy_get("upload");
+  VALUE stream;
+
+  if (NIL_P(upload)) {
+    return curl_seek_fail_result();
+  }
+
+  stream = ruby_curl_upload_stream_get(upload);
+
+  if (rb_respond_to(stream, rb_intern("seek"))) {
+    struct stream_seek_call_args args;
+    args.stream = stream;
+    args.offset = offset;
+    args.origin = origin;
+    rescue_easy_callback(rbce, call_stream_seek, (VALUE)&args);
+    if (!NIL_P(rbce->callback_error)) {
+      return curl_seek_fail_result();
+    }
+  } else {
+    ruby_curl_upload *rbcu;
+    TypedData_Get_Struct(upload, ruby_curl_upload, &ruby_curl_upload_data_type, rbcu);
+    // This OK because curl only uses SEEK_SET as per the documentation
+    rbcu->offset = offset;
+  }
+
+  return 0;
+}
+
 static size_t proc_data_handler(char *stream,
                                 size_t size,
                                 size_t nmemb,
@@ -120,22 +1041,44 @@ static size_t proc_data_handler_body(char *stream,
                                      size_t nmemb,
                                      ruby_curl_easy *rbce)
 {
-  size_t ret;
-  rbce->callback_active = 1;
-  ret = proc_data_handler(stream, size, nmemb, rb_easy_get("body_proc"));
-  rbce->callback_active = 0;
-  return ret;
+  struct proc_data_call_args args;
+  struct easy_callback_dispatch_args dispatch_args;
+  VALUE procret;
+  args.stream = stream;
+  args.size = size;
+  args.nmemb = nmemb;
+  args.proc = rb_easy_get("body_proc");
+
+  if (ruby_curl_easy_body_limit_exceeded(rbce, size * nmemb)) {
+    return 0;
+  }
+
+  dispatch_args.rbce = rbce;
+  dispatch_args.func = call_proc_data_handler_wrapped;
+  dispatch_args.arg = (VALUE)&args;
+  procret = rb_rescue(call_with_easy_callback_active, (VALUE)&dispatch_args, callback_exception_store_on_easy, (VALUE)rbce);
+
+  return ((procret == Qfalse) || (procret == Qnil)) ? 0 : NUM2ULONG(procret);
 }
 static size_t proc_data_handler_header(char *stream,
                                        size_t size,
                                        size_t nmemb,
                                        ruby_curl_easy *rbce)
 {
-  size_t ret;
-  rbce->callback_active = 1;
-  ret = proc_data_handler(stream, size, nmemb, rb_easy_get("header_proc"));
-  rbce->callback_active = 0;
-  return ret;
+  struct proc_data_call_args args;
+  struct easy_callback_dispatch_args dispatch_args;
+  VALUE procret;
+  args.stream = stream;
+  args.size = size;
+  args.nmemb = nmemb;
+  args.proc = rb_easy_get("header_proc");
+
+  dispatch_args.rbce = rbce;
+  dispatch_args.func = call_proc_data_handler_wrapped;
+  dispatch_args.arg = (VALUE)&args;
+  procret = rb_rescue(call_with_easy_callback_active, (VALUE)&dispatch_args, callback_exception_store_on_easy, (VALUE)rbce);
+
+  return ((procret == Qfalse) || (procret == Qnil)) ? 0 : NUM2ULONG(procret);
 }
 
 
@@ -147,11 +1090,18 @@ static VALUE call_progress_handler(VALUE ary) {
                     rb_ary_entry(ary, 4)); // rb_float_new(ulnow));
 }
 
-static int proc_progress_handler(VALUE proc,
+/* CURLOPT_PROGRESSFUNCTION callback (deprecated since 7.32.0) */
+#ifndef HAVE_CURLOPT_XFERINFOFUNCTION
+static int proc_progress_handler(void *clientp,
                                  double dltotal,
                                  double dlnow,
                                  double ultotal,
                                  double ulnow) {
+  ruby_curl_easy *rbce = (ruby_curl_easy *)clientp;
+  VALUE proc = rb_easy_get("progress_proc");
+  if (proc == Qnil) {
+    return 0;
+  }
   VALUE procret;
   VALUE callargs = rb_ary_new2(5);
 
@@ -161,71 +1111,297 @@ static int proc_progress_handler(VALUE proc,
   rb_ary_store(callargs, 3, rb_float_new(ultotal));
   rb_ary_store(callargs, 4, rb_float_new(ulnow));
 
-	//v = rb_rescue(range_check, (VALUE)args, range_failed, 0);
-  //procret = rb_funcall(proc, idCall, 4, rb_float_new(dltotal),
-  //                                      rb_float_new(dlnow),
-  //                                      rb_float_new(ultotal),
-  //                                      rb_float_new(ulnow));
-  procret = rb_rescue(call_progress_handler, callargs, callback_exception, Qnil);
+  struct easy_callback_dispatch_args dispatch_args;
+  dispatch_args.rbce = rbce;
+  dispatch_args.func = call_progress_handler;
+  dispatch_args.arg = callargs;
+  procret = rb_rescue(call_with_easy_callback_active, (VALUE)&dispatch_args, callback_exception, Qnil);
+
+  return(((procret == Qfalse) || (procret == Qnil)) ? -1 : 0);
+}
+#endif
+
+/* CURLOPT_XFERINFOFUNCTION callback (since 7.32.0, replaces PROGRESSFUNCTION) */
+#ifdef HAVE_CURLOPT_XFERINFOFUNCTION
+static int proc_xferinfo_handler(void *clientp,
+                                 curl_off_t dltotal,
+                                 curl_off_t dlnow,
+                                 curl_off_t ultotal,
+                                 curl_off_t ulnow) {
+  ruby_curl_easy *rbce = (ruby_curl_easy *)clientp;
+  VALUE proc = rb_easy_get("progress_proc");
+  if (proc == Qnil) {
+    return 0;
+  }
+  VALUE procret;
+  VALUE callargs = rb_ary_new2(5);
+
+  rb_ary_store(callargs, 0, proc);
+  rb_ary_store(callargs, 1, LL2NUM(dltotal));
+  rb_ary_store(callargs, 2, LL2NUM(dlnow));
+  rb_ary_store(callargs, 3, LL2NUM(ultotal));
+  rb_ary_store(callargs, 4, LL2NUM(ulnow));
+
+  struct easy_callback_dispatch_args dispatch_args;
+  dispatch_args.rbce = rbce;
+  dispatch_args.func = call_progress_handler;
+  dispatch_args.arg = callargs;
+  procret = rb_rescue(call_with_easy_callback_active, (VALUE)&dispatch_args, callback_exception, Qnil);
 
   return(((procret == Qfalse) || (procret == Qnil)) ? -1 : 0);
 }
+#endif
 
 static VALUE call_debug_handler(VALUE ary) {
   return rb_funcall(rb_ary_entry(ary, 0), idCall, 2,
-                    rb_ary_entry(ary, 1), // INT2FIX(type),
+                    rb_ary_entry(ary, 1), // INT2NUM(type),
                     rb_ary_entry(ary, 2)); // rb_str_new(data, data_len)
 }
 static int proc_debug_handler(CURL *curl,
                               curl_infotype type,
                               char *data,
                               size_t data_len,
-                              VALUE proc) {
+                              void *clientp) {
+  ruby_curl_easy *rbce = (ruby_curl_easy *)clientp;
+  VALUE proc = rb_easy_get("debug_proc");
+  if (proc == Qnil) {
+    return 0;
+  }
   VALUE callargs = rb_ary_new2(3);
   rb_ary_store(callargs, 0, proc);
-  rb_ary_store(callargs, 1, INT2FIX(type));
+  rb_ary_store(callargs, 1, INT2NUM(type));
   rb_ary_store(callargs, 2, rb_str_new(data, data_len));
-  rb_rescue(call_debug_handler, callargs, callback_exception, Qnil);
+  struct easy_callback_dispatch_args dispatch_args;
+  dispatch_args.rbce = rbce;
+  dispatch_args.func = call_debug_handler;
+  dispatch_args.arg = callargs;
+  rb_rescue(call_with_easy_callback_active, (VALUE)&dispatch_args, callback_exception, Qnil);
   /* no way to indicate to libcurl that we should break out given an exception in the on_debug handler...
    * this means exceptions will be swallowed
    */
-  //rb_funcall(proc, idCall, 2, INT2FIX(type), rb_str_new(data, data_len));
+  //rb_funcall(proc, idCall, 2, INT2NUM(type), rb_str_new(data, data_len));
   return 0;
 }
 
-/* ================== MARK/FREE FUNC ==================*/
-void curl_easy_mark(ruby_curl_easy *rbce) {
-  if (!NIL_P(rbce->opts)) { rb_gc_mark(rbce->opts); }
-  if (!NIL_P(rbce->multi)) { rb_gc_mark(rbce->multi); }
+/* ================== MARK/FREE/SIZE FUNCS ==================*/
+static void curl_easy_mark(void *ptr) {
+  ruby_curl_easy *rbce = (ruby_curl_easy *)ptr;
+  if (rbce) {
+    if (!NIL_P(rbce->opts)) { rb_gc_mark(rbce->opts); }
+    if (!NIL_P(rbce->multi)) { rb_gc_mark(rbce->multi); }
+    if (!NIL_P(rbce->callback_error)) { rb_gc_mark(rbce->callback_error); }
+  }
+}
+
+static void ruby_curl_easy_clear_headers_list(ruby_curl_easy *rbce) {
+  if (!rbce || !rbce->curl_headers) {
+    return;
+  }
+  if (rbce->curl) {
+    curl_easy_setopt(rbce->curl, CURLOPT_HTTPHEADER, NULL);
+  }
+  curl_slist_free_all(rbce->curl_headers);
+  rbce->curl_headers = NULL;
+}
+
+static void ruby_curl_easy_clear_proxy_headers_list(ruby_curl_easy *rbce) {
+  if (!rbce || !rbce->curl_proxy_headers) {
+    return;
+  }
+#ifdef HAVE_CURLOPT_PROXYHEADER
+  if (rbce->curl) {
+    curl_easy_setopt(rbce->curl, CURLOPT_PROXYHEADER, NULL);
+  }
+#endif
+  curl_slist_free_all(rbce->curl_proxy_headers);
+  rbce->curl_proxy_headers = NULL;
+}
+
+static void ruby_curl_easy_clear_ftp_commands_list(ruby_curl_easy *rbce) {
+  if (!rbce || !rbce->curl_ftp_commands) {
+    return;
+  }
+  if (rbce->curl) {
+    curl_easy_setopt(rbce->curl, CURLOPT_QUOTE, NULL);
+  }
+  curl_slist_free_all(rbce->curl_ftp_commands);
+  rbce->curl_ftp_commands = NULL;
+}
+
+static void ruby_curl_easy_clear_resolve_list(ruby_curl_easy *rbce) {
+  if (!rbce || !rbce->curl_resolve) {
+    return;
+  }
+#ifdef HAVE_CURLOPT_RESOLVE
+  if (rbce->curl) {
+    curl_easy_setopt(rbce->curl, CURLOPT_RESOLVE, NULL);
+  }
+#endif
+  curl_slist_free_all(rbce->curl_resolve);
+  rbce->curl_resolve = NULL;
+}
+
+static void ruby_curl_easy_clear_connect_to_list(ruby_curl_easy *rbce) {
+  if (!rbce || !rbce->curl_connect_to) {
+    return;
+  }
+#ifdef HAVE_CURLOPT_CONNECT_TO
+  if (rbce->curl) {
+    curl_easy_setopt(rbce->curl, CURLOPT_CONNECT_TO, NULL);
+  }
+#endif
+  curl_slist_free_all(rbce->curl_connect_to);
+  rbce->curl_connect_to = NULL;
+}
+
+static void ruby_curl_easy_clear_setup_lists(ruby_curl_easy *rbce) {
+  ruby_curl_easy_clear_headers_list(rbce);
+  ruby_curl_easy_clear_proxy_headers_list(rbce);
+  ruby_curl_easy_clear_ftp_commands_list(rbce);
+  ruby_curl_easy_clear_resolve_list(rbce);
+  ruby_curl_easy_clear_connect_to_list(rbce);
+}
+
+/* Legacy wrapper for external callers */
+void ruby_curl_easy_mark(ruby_curl_easy *rbce) {
+  curl_easy_mark((void *)rbce);
+}
+
+static ruby_curl_multi *ruby_curl_multi_pointer_if_compatible(VALUE multi_val) {
+  if (NIL_P(multi_val) || !RB_TYPE_P(multi_val, T_DATA)) {
+    return NULL;
+  }
+
+#if defined(RTYPEDDATA_P) && defined(RTYPEDDATA_TYPE) && defined(RTYPEDDATA_DATA)
+  if (!RTYPEDDATA_P(multi_val)) {
+    return NULL;
+  }
+
+  if (RTYPEDDATA_TYPE(multi_val) != &ruby_curl_multi_data_type) {
+    return NULL;
+  }
+
+  return (ruby_curl_multi *)RTYPEDDATA_DATA(multi_val);
+#else
+  if (!rb_typeddata_is_kind_of(multi_val, &ruby_curl_multi_data_type)) {
+    return NULL;
+  }
+
+  return DATA_PTR(multi_val);
+#endif
 }
 
 static void ruby_curl_easy_free(ruby_curl_easy *rbce) {
-  if (rbce->curl_headers) {
-    curl_slist_free_all(rbce->curl_headers);
+  if (!rbce) {
+    return;
   }
 
-  if (rbce->curl_ftp_commands) {
-    curl_slist_free_all(rbce->curl_ftp_commands);
+  if (!NIL_P(rbce->multi)) {
+    VALUE multi_val = rbce->multi;
+    ruby_curl_multi *rbcm = ruby_curl_multi_pointer_if_compatible(multi_val);
+
+    rbce->multi = Qnil;
+
+    if (rbcm) {
+      /* Best-effort: ensure the handle is detached from the multi to avoid
+       * libcurl retaining a dangling pointer to a soon-to-be cleaned-up easy
+       * handle. This path runs during GC, so it must not invoke Ruby APIs that
+       * can allocate or raise. */
+      if (rbcm->handle && rbce->curl) {
+        curl_multi_remove_handle(rbcm->handle, rbce->curl);
+      }
+      rb_curl_multi_forget_easy(rbcm, rbce);
+    }
   }
 
+  ruby_curl_easy_clear_headers_list(rbce);
+  ruby_curl_easy_clear_proxy_headers_list(rbce);
+  ruby_curl_easy_clear_ftp_commands_list(rbce);
+  ruby_curl_easy_clear_resolve_list(rbce);
+  ruby_curl_easy_clear_connect_to_list(rbce);
+  curb_clear_network_allowed_cidr_rules(rbce);
+  curb_clear_network_allowed_hosts(rbce);
+
   if (rbce->curl) {
+    /* disable any progress or debug events */
+    curl_easy_setopt(rbce->curl, CURLOPT_WRITEFUNCTION, NULL);
+    curl_easy_setopt(rbce->curl, CURLOPT_WRITEDATA, NULL);
+    curl_easy_setopt(rbce->curl, CURLOPT_HEADERFUNCTION, NULL);
+    curl_easy_setopt(rbce->curl, CURLOPT_HEADERDATA, NULL);
+    curl_easy_setopt(rbce->curl, CURLOPT_DEBUGFUNCTION, NULL);
+    curl_easy_setopt(rbce->curl, CURLOPT_DEBUGDATA, NULL);
+    curl_easy_setopt(rbce->curl, CURLOPT_VERBOSE, 0);
+#ifdef HAVE_CURLOPT_XFERINFOFUNCTION
+    curl_easy_setopt(rbce->curl, CURLOPT_XFERINFOFUNCTION, NULL);
+#else
+    curl_easy_setopt(rbce->curl, CURLOPT_PROGRESSFUNCTION, NULL);
+#endif
+    curl_easy_setopt(rbce->curl, CURLOPT_NOPROGRESS, 1);
     curl_easy_cleanup(rbce->curl);
+    rbce->curl = NULL;
   }
+
+  rbce->self = Qnil;
 }
 
-void curl_easy_free(ruby_curl_easy *rbce) {
-  ruby_curl_easy_free(rbce);
-  free(rbce);
+/* TypedData-compatible free function */
+static void curl_easy_free(void *ptr) {
+  ruby_curl_easy *rbce = (ruby_curl_easy *)ptr;
+  if (rbce) {
+    ruby_curl_easy_free(rbce);
+    free(rbce);
+  }
+}
+
+/* Legacy wrapper for external callers (e.g., curb_multi) */
+void ruby_curl_easy_free_wrapper(ruby_curl_easy *rbce) {
+  curl_easy_free((void *)rbce);
 }
 
+static size_t curl_easy_memsize(const void *ptr) {
+  const ruby_curl_easy *rbce = (const ruby_curl_easy *)ptr;
+  size_t size = sizeof(ruby_curl_easy);
+  /* Note: We don't count curl_slist or CURL handle memory as they're
+   * managed by libcurl and would require complex introspection */
+  (void)rbce; /* silence unused warning */
+  return size;
+}
+
+const rb_data_type_t ruby_curl_easy_data_type = {
+  "Curl::Easy",
+  {
+    curl_easy_mark,
+    curl_easy_free,
+    curl_easy_memsize,
+#ifdef RUBY_TYPED_FREE_IMMEDIATELY
+    NULL, /* compact - not needed */
+#endif
+  },
+#ifdef RUBY_TYPED_FREE_IMMEDIATELY
+  NULL, NULL, /* parent, data */
+  RUBY_TYPED_FREE_IMMEDIATELY
+#endif
+};
+
 
 /* ================= ALLOC METHODS ====================*/
 
 static void ruby_curl_easy_zero(ruby_curl_easy *rbce) {
   rbce->opts = rb_hash_new();
 
+  memset(rbce->err_buf, 0, CURL_ERROR_SIZE);
+  memset(rbce->unsafe_destination_error, 0, CURL_ERROR_SIZE);
+
+  rbce->self = Qnil;
   rbce->curl_headers = NULL;
+  rbce->curl_proxy_headers = NULL;
   rbce->curl_ftp_commands = NULL;
+  rbce->curl_resolve = NULL;
+  rbce->curl_connect_to = NULL;
+  rbce->network_allowed_cidr_rules = NULL;
+  rbce->network_allowed_hosts = NULL;
+  rbce->network_allowed_cidr_rule_count = 0;
+  rbce->network_allowed_host_count = 0;
 
   /* various-typed opts */
   rbce->local_port = 0;
@@ -236,15 +1412,21 @@ static void ruby_curl_easy_zero(ruby_curl_easy *rbce) {
   rbce->proxy_auth_types = 0;
   rbce->max_redirs = -1;
   rbce->timeout = 0;
+  rbce->timeout_ms = 0;
   rbce->connect_timeout = 0;
+  rbce->connect_timeout_ms = 0;
   rbce->dns_cache_timeout = 60;
   rbce->ftp_response_timeout = 0;
   rbce->low_speed_limit = 0;
   rbce->low_speed_time = 0;
+  rbce->max_send_speed_large = 0;
+  rbce->max_recv_speed_large = 0;
   rbce->ssl_version = -1;
   rbce->use_ssl = -1;
   rbce->ftp_filemethod = -1;
+  rbce->http_version = CURL_HTTP_VERSION_NONE;
   rbce->resolve_mode = CURL_IPRESOLVE_WHATEVER;
+  rbce->network_policy = CURB_NETWORK_POLICY_NONE;
 
   /* bool opts */
   rbce->proxy_tunnel = 0;
@@ -258,29 +1440,53 @@ static void ruby_curl_easy_zero(ruby_curl_easy *rbce) {
   rbce->verbose = 0;
   rbce->multipart_form_post = 0;
   rbce->enable_cookies = 0;
+  rbce->cookielist_engine_enabled = 0;
   rbce->ignore_content_length = 0;
   rbce->callback_active = 0;
+  rbce->unsafe_destination_blocked = 0;
+  rbce->allow_proxy = 0;
+  rbce->allow_unix_socket = 0;
+  rbce->forbid_reuse_set = 0;
+  rbce->native_active = 0;
+  rbce->forbid_reuse = 0;
+  rbce->callback_error = Qnil;
+  rbce->last_result = 0;
+}
+
+/*
+ * Allocate space for a Curl::Easy instance.
+ */
+static VALUE ruby_curl_easy_allocate(VALUE klass) {
+  ruby_curl_easy *rbce;
+  rbce = ALLOC(ruby_curl_easy);
+  if (!rbce) {
+    rb_raise(rb_eNoMemError, "Failed to allocate memory for Curl::Easy");
+  }
+  rbce->curl = NULL;
+  rbce->opts  = Qnil;
+  rbce->multi = Qnil;
+  ruby_curl_easy_zero(rbce);
+  return TypedData_Wrap_Struct(klass, &ruby_curl_easy_data_type, rbce);
 }
 
 /*
  * call-seq:
- *   Curl::Easy.new                                   => #&lt;Curl::Easy...&gt;
- *   Curl::Easy.new(url = nil)                        => #&lt;Curl::Easy...&gt;
- *   Curl::Easy.new(url = nil) { |self| ... }         => #&lt;Curl::Easy...&gt;
+ *   Curl::Easy.new                                   => #<Curl::Easy...>
+ *   Curl::Easy.new(url = nil)                        => #<Curl::Easy...>
+ *   Curl::Easy.new(url = nil) { |self| ... }         => #<Curl::Easy...>
  *
- * Create a new Curl::Easy instance, optionally supplying the URL.
+ * Initialize a new Curl::Easy instance, optionally supplying the URL.
  * The block form allows further configuration to be supplied before
  * the instance is returned.
  */
-static VALUE ruby_curl_easy_new(int argc, VALUE *argv, VALUE klass) {
+static VALUE ruby_curl_easy_initialize(int argc, VALUE *argv, VALUE self) {
   CURLcode ecode;
   VALUE url, blk;
-  VALUE new_curl;
   ruby_curl_easy *rbce;
 
   rb_scan_args(argc, argv, "01&", &url, &blk);
 
-  rbce = ALLOC(ruby_curl_easy);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
 
   /* handler */
   rbce->curl = curl_easy_init();
@@ -288,32 +1494,67 @@ static VALUE ruby_curl_easy_new(int argc, VALUE *argv, VALUE klass) {
     rb_raise(eCurlErrFailedInit, "Failed to initialize easy handle");
   }
 
-  new_curl = Data_Wrap_Struct(klass, curl_easy_mark, curl_easy_free, rbce);
-
   rbce->multi = Qnil;
   rbce->opts  = Qnil;
 
   ruby_curl_easy_zero(rbce);
+  rbce->self = self;
+
+  curl_easy_setopt(rbce->curl, CURLOPT_ERRORBUFFER, &rbce->err_buf);
 
   rb_easy_set("url", url);
 
-  /* set the new_curl pointer to the curl handle */
-  ecode = curl_easy_setopt(rbce->curl, CURLOPT_PRIVATE, (void*)new_curl);
+  /* set the pointer to the curl handle */
+  ecode = curl_easy_setopt(rbce->curl, CURLOPT_PRIVATE, (void*)rbce);
   if (ecode != CURLE_OK) {
     raise_curl_easy_error_exception(ecode);
   }
 
   if (blk != Qnil) {
-    rb_funcall(blk, idCall, 1, new_curl);
+    rb_funcall(blk, idCall, 1, self);
   }
 
-  return new_curl;
+  return self;
+}
+
+/* Helper to duplicate a curl_slist */
+static struct curl_slist *duplicate_curl_slist(struct curl_slist *list) {
+    struct curl_slist *dup = NULL;
+    struct curl_slist *tmp;
+    struct curl_slist *new_list;
+    for (tmp = list; tmp; tmp = tmp->next) {
+        new_list = curl_slist_append(dup, tmp->data);
+        if (!new_list) {
+            if (dup) { curl_slist_free_all(dup); }
+            rb_raise(rb_eNoMemError, "Failed to duplicate curl_slist");
+        }
+        dup = new_list;
+    }
+    return dup;
+}
+
+static VALUE duplicate_upload(VALUE upload) {
+  ruby_curl_upload *rbcu, *newrbcu;
+  VALUE new_upload;
+
+  if (NIL_P(upload)) {
+    return Qnil;
+  }
+
+  TypedData_Get_Struct(upload, ruby_curl_upload, &ruby_curl_upload_data_type, rbcu);
+
+  new_upload = ruby_curl_upload_new(cCurlUpload);
+  TypedData_Get_Struct(new_upload, ruby_curl_upload, &ruby_curl_upload_data_type, newrbcu);
+  newrbcu->stream = rbcu->stream;
+  newrbcu->offset = rbcu->offset;
+
+  return new_upload;
 }
 
 /*
  * call-seq:
- *   easy.clone                                       => #&lt;easy clone&gt;
- *   easy.dup                                         => #&lt;easy clone&gt;
+ *   easy.clone                                       => <easy clone>
+ *   easy.dup                                         => <easy clone>
  *
  * Clone this Curl::Easy instance, creating a new instance.
  * This method duplicates the underlying CURL* handle.
@@ -321,15 +1562,65 @@ static VALUE ruby_curl_easy_new(int argc, VALUE *argv, VALUE klass) {
 static VALUE ruby_curl_easy_clone(VALUE self) {
   ruby_curl_easy *rbce, *newrbce;
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
 
   newrbce = ALLOC(ruby_curl_easy);
+  if (!newrbce) {
+    rb_raise(rb_eNoMemError, "Failed to allocate memory for Curl::Easy clone");
+  }
+  /* shallow copy */
   memcpy(newrbce, rbce, sizeof(ruby_curl_easy));
+
+  /* now deep copy */
   newrbce->curl = curl_easy_duphandle(rbce->curl);
-  newrbce->curl_headers = NULL;
-  newrbce->curl_ftp_commands = NULL;
+  if (!newrbce->curl) {
+    free(newrbce);
+    rb_raise(rb_eNoMemError, "Failed to duplicate Curl::Easy handle");
+  }
+  newrbce->curl_headers = (rbce->curl_headers) ? duplicate_curl_slist(rbce->curl_headers) : NULL;
+  newrbce->curl_proxy_headers = (rbce->curl_proxy_headers) ? duplicate_curl_slist(rbce->curl_proxy_headers) : NULL;
+  newrbce->curl_ftp_commands = (rbce->curl_ftp_commands) ? duplicate_curl_slist(rbce->curl_ftp_commands) : NULL;
+  newrbce->curl_resolve = (rbce->curl_resolve) ? duplicate_curl_slist(rbce->curl_resolve) : NULL;
+  newrbce->curl_connect_to = (rbce->curl_connect_to) ? duplicate_curl_slist(rbce->curl_connect_to) : NULL;
+  newrbce->network_allowed_cidr_rules = NULL;
+  newrbce->network_allowed_cidr_rule_count = 0;
+  newrbce->network_allowed_hosts = NULL;
+  newrbce->network_allowed_host_count = 0;
+
+  /* A cloned easy should not retain ownership reference to the original multi. */
+  newrbce->multi = Qnil;
+  newrbce->callback_error = Qnil;
+  newrbce->unsafe_destination_blocked = 0;
+  memset(newrbce->unsafe_destination_error, 0, CURL_ERROR_SIZE);
+  newrbce->native_active = 0;
+
+  if (rbce->opts != Qnil) {
+    newrbce->opts = rb_funcall(rbce->opts, rb_intern("dup"), 0);
+  }
 
-  return Data_Wrap_Struct(cCurlEasy, curl_easy_mark, curl_easy_free, newrbce);
+  /* Set the error buffer on the new curl handle using the new err_buf */
+  curl_easy_setopt(newrbce->curl, CURLOPT_ERRORBUFFER, newrbce->err_buf);
+
+  if (newrbce->opts != Qnil) {
+    VALUE upload = rb_hash_aref(newrbce->opts, rb_easy_hkey("upload"));
+    if (!NIL_P(upload)) {
+      rb_hash_aset(newrbce->opts, rb_easy_hkey("upload"), duplicate_upload(upload));
+      curl_easy_setopt(newrbce->curl, CURLOPT_READFUNCTION, (curl_read_callback)read_data_handler);
+      curl_easy_setopt(newrbce->curl, CURLOPT_READDATA, newrbce);
+#ifdef HAVE_CURLOPT_SEEKFUNCTION
+      curl_easy_setopt(newrbce->curl, CURLOPT_SEEKFUNCTION, (curl_seek_callback)seek_data_handler);
+#endif
+#ifdef HAVE_CURLOPT_SEEKDATA
+      curl_easy_setopt(newrbce->curl, CURLOPT_SEEKDATA, newrbce);
+#endif
+    }
+  }
+
+  VALUE clone = TypedData_Wrap_Struct(cCurlEasy, &ruby_curl_easy_data_type, newrbce);
+  newrbce->self = clone;
+  curl_easy_setopt(newrbce->curl, CURLOPT_PRIVATE, (void*)newrbce);
+
+  return clone;
 }
 
 /*
@@ -337,19 +1628,23 @@ static VALUE ruby_curl_easy_clone(VALUE self) {
  *   easy.close                                      => nil
  *
  * Close the Curl::Easy instance. Any open connections are closed
- * The easy handle is reinitialized.  If a previous multi handle was 
+ * The easy handle is reinitialized.  If a previous multi handle was
  * open it is set to nil and will be cleared after a GC.
  */
 static VALUE ruby_curl_easy_close(VALUE self) {
   CURLcode ecode;
   ruby_curl_easy *rbce;
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
 
   if (rbce->callback_active) {
     rb_raise(rb_eRuntimeError, "Cannot close an active curl handle within a callback");
   }
 
+  if (rbce->native_active) {
+    rb_raise(rb_eRuntimeError, "Cannot close an active curl handle during native operation");
+  }
+
   ruby_curl_easy_free(rbce);
 
   /* reinit the handle */
@@ -361,9 +1656,12 @@ static VALUE ruby_curl_easy_close(VALUE self) {
   rbce->multi = Qnil;
 
   ruby_curl_easy_zero(rbce);
+  rbce->self = self;
+
+  curl_easy_setopt(rbce->curl, CURLOPT_ERRORBUFFER, rbce->err_buf);
 
   /* give the new curl handle a reference back to the ruby object */
-  ecode = curl_easy_setopt(rbce->curl, CURLOPT_PRIVATE, (void*)self);
+  ecode = curl_easy_setopt(rbce->curl, CURLOPT_PRIVATE, (void*)rbce);
   if (ecode != CURLE_OK) {
     raise_curl_easy_error_exception(ecode);
   }
@@ -387,29 +1685,31 @@ static VALUE ruby_curl_easy_reset(VALUE self) {
   CURLcode ecode;
   ruby_curl_easy *rbce;
   VALUE opts_dup;
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
 
   if (rbce->callback_active) {
     rb_raise(rb_eRuntimeError, "Cannot close an active curl handle within a callback");
   }
 
+  if (rbce->native_active) {
+    rb_raise(rb_eRuntimeError, "Cannot reset an active curl handle during native operation");
+  }
+
   opts_dup = rb_funcall(rbce->opts, rb_intern("dup"), 0);
 
+  ruby_curl_easy_cleanup(self, rbce);
   curl_easy_reset(rbce->curl);
   ruby_curl_easy_zero(rbce);
+  rbce->self = self;
 
-  /* rest clobbers the private setting, so reset it to self */
-  ecode = curl_easy_setopt(rbce->curl, CURLOPT_PRIVATE, (void*)self);
+  curl_easy_setopt(rbce->curl, CURLOPT_ERRORBUFFER, &rbce->err_buf);
+
+  /* reset clobbers the private setting, so reset it to self */
+  ecode = curl_easy_setopt(rbce->curl, CURLOPT_PRIVATE, (void*)rbce);
   if (ecode != CURLE_OK) {
     raise_curl_easy_error_exception(ecode);
   }
 
-  /* Free everything up */
-  if (rbce->curl_headers) {
-    curl_slist_free_all(rbce->curl_headers);
-    rbce->curl_headers = NULL;
-  }
-
   return opts_dup;
 }
 
@@ -462,6 +1762,10 @@ static VALUE ruby_curl_easy_headers_set(VALUE self, VALUE headers) {
   CURB_OBJECT_HSETTER(ruby_curl_easy, headers);
 }
 
+static VALUE ruby_curl_easy_proxy_headers_set(VALUE self, VALUE proxy_headers) {
+  CURB_OBJECT_HSETTER(ruby_curl_easy, proxy_headers);
+}
+
 /*
  * call-seq:
  *   easy.headers                                     => Hash, Array or Str
@@ -471,12 +1775,47 @@ static VALUE ruby_curl_easy_headers_set(VALUE self, VALUE headers) {
 static VALUE ruby_curl_easy_headers_get(VALUE self) {
   ruby_curl_easy *rbce;
   VALUE headers;
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
-  headers = rb_easy_get("headers");//rb_hash_aref(rbce->opts, rb_intern("headers")); 
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
+  headers = rb_easy_get("headers");//rb_hash_aref(rbce->opts, rb_intern("headers"));
   if (headers == Qnil) { headers = rb_easy_set("headers", rb_hash_new()); }
   return headers;
 }
 
+/*
+ * call-seq:
+ *   easy.proxy_headers = "Header: val"                              => "Header: val"
+ *   easy.proxy_headers = {"Header" => "val" ..., "Header" => "val"} => {"Header: val", ...}
+ *   easy.proxy_headers = ["Header: val" ..., "Header: val"]         => ["Header: val", ...]
+ *
+ *
+ * For example to set a standard or custom header:
+ *
+ *    easy.proxy_headers["MyHeader"] = "myval"
+ *
+ * To remove a standard header (this is useful when removing libcurls default
+ * 'Expect: 100-Continue' header when using HTTP form posts):
+ *
+ *    easy.proxy_headers["Expect"] = ''
+ *
+ * Anything passed to libcurl as a header will be converted to a string during
+ * the perform step.
+ */
+
+/*
+ * call-seq:
+ *   easy.proxy_headers                                     => Hash, Array or Str
+ *
+ * Obtain the custom HTTP proxy_headers for following requests.
+ */
+static VALUE ruby_curl_easy_proxy_headers_get(VALUE self) {
+  ruby_curl_easy *rbce;
+  VALUE proxy_headers;
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
+  proxy_headers = rb_easy_get("proxy_headers");//rb_hash_aref(rbce->opts, rb_intern("proxy_headers"));
+  if (proxy_headers == Qnil) { proxy_headers = rb_easy_set("proxy_headers", rb_hash_new()); }
+  return proxy_headers;
+}
+
 /*
  * call-seq:
  *   easy.interface                                   => string
@@ -515,7 +1854,16 @@ static VALUE ruby_curl_easy_proxypwd_get(VALUE self) {
  * call-seq:
  *   easy.cookies                                     => "name1=content1; name2=content2;"
  *
- * Obtain the cookies for this Curl::Easy instance.
+ * Obtain the manually set Cookie header string for this Curl::Easy instance.
+ *
+ * Notes:
+ * - This corresponds to libcurl's CURLOPT_COOKIE and only affects the outgoing
+ *   Cookie request header. It does NOT modify the internal libcurl cookie engine
+ *   that stores cookies received via Set-Cookie.
+ * - To inspect or modify cookies stored in the cookie engine, use
+ *   +easy.cookielist+ (getter) and +easy.cookielist=+ or +easy.set(:cookielist, ...)+ (setter).
+ * - To clear a previously set manual Cookie header, assign an empty string.
+ *   Assigning +nil+ currently has no effect.
  */
 static VALUE ruby_curl_easy_cookies_get(VALUE self) {
   CURB_OBJECT_HGETTER(ruby_curl_easy, cookies);
@@ -525,7 +1873,8 @@ static VALUE ruby_curl_easy_cookies_get(VALUE self) {
  * call-seq:
  *   easy.cookiefile                                  => string
  *
- * Obtain the cookiefile file for this Curl::Easy instance.
+ * Obtain the cookiefile path for this Curl::Easy instance (used to load cookies when the
+ * cookie engine is enabled).
  */
 static VALUE ruby_curl_easy_cookiefile_get(VALUE self) {
   CURB_OBJECT_HGETTER(ruby_curl_easy, cookiefile);
@@ -535,7 +1884,8 @@ static VALUE ruby_curl_easy_cookiefile_get(VALUE self) {
  * call-seq:
  *   easy.cookiejar                                   => string
  *
- * Obtain the cookiejar file to use for this Curl::Easy instance.
+ * Obtain the cookiejar path for this Curl::Easy instance (used to persist cookies when the
+ * cookie engine is enabled).
  */
 static VALUE ruby_curl_easy_cookiejar_get(VALUE self) {
   CURB_OBJECT_HGETTER(ruby_curl_easy, cookiejar);
@@ -684,57 +2034,102 @@ static VALUE ruby_curl_easy_useragent_get(VALUE self) {
 /*
  * call-seq:
  *   easy.post_body = "some=form%20data&to=send"      => string or nil
- * 
+ *
  * Sets the POST body of this Curl::Easy instance.  This is expected to be
  * URL encoded; no additional processing or encoding is done on the string.
  * The content-type header will be set to application/x-www-form-urlencoded.
- * 
+ *
  * This is handy if you want to perform a POST against a Curl::Multi instance.
  */
-static VALUE ruby_curl_easy_post_body_set(VALUE self, VALUE post_body) {
+struct post_body_set_args {
+  VALUE self;
+  VALUE post_body;
+  int force_http_get_on_nil;
+};
+
+static VALUE ruby_curl_easy_post_body_set_with_mode_body(VALUE argp) {
+  struct post_body_set_args *args = (struct post_body_set_args *)argp;
+  VALUE self = args->self;
+  VALUE post_body = args->post_body;
+  int force_http_get_on_nil = args->force_http_get_on_nil;
   ruby_curl_easy *rbce;
   CURL *curl;
-  
+
+  VALUE body_str;
+  VALUE retained_body_str;
   char *data;
   long len;
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
-  
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
+
   curl = rbce->curl;
-  
+
   if ( post_body == Qnil ) {
     rb_easy_del("postdata_buffer");
-    curl_easy_setopt(curl, CURLOPT_HTTPGET, 1);
-    
-  } else {  
+    curl_easy_setopt(curl, CURLOPT_POSTFIELDS, NULL);
+    curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, 0);
+    if (force_http_get_on_nil) {
+      curl_easy_setopt(curl, CURLOPT_HTTPGET, 1);
+    }
+
+  } else {
     if (rb_type(post_body) == T_STRING) {
-      data = StringValuePtr(post_body);
-      len = RSTRING_LEN(post_body);
+      body_str = post_body;
     }
     else if (rb_respond_to(post_body, rb_intern("to_s"))) {
-      VALUE str_body = rb_funcall(post_body, rb_intern("to_s"), 0);
-      data = StringValuePtr(str_body);
-      len = RSTRING_LEN(post_body);
+      body_str = rb_funcall(post_body, rb_intern("to_s"), 0);
     }
     else {
       rb_raise(rb_eRuntimeError, "post data must respond_to .to_s");
     }
-  
-    // Store the string, since it has to hang around for the duration of the 
+
+    StringValue(body_str);
+
+    // Store the string, since it has to hang around for the duration of the
     // request.  See CURLOPT_POSTFIELDS in the libcurl docs.
-    //rbce->postdata_buffer = post_body;
-    rb_easy_set("postdata_buffer", post_body);
-  
+#ifdef HAVE_CURLOPT_COPYPOSTFIELDS
+    /*
+     * libcurl copies the bytes immediately for COPYPOSTFIELDS, so retain a
+     * matching Ruby snapshot for post_body instead of the caller's mutable
+     * source string.
+     */
+    retained_body_str = rb_str_dup(body_str);
+#else
+    retained_body_str = body_str;
+#endif
+    data = StringValuePtr(retained_body_str);
+    len = RSTRING_LEN(retained_body_str);
+    rb_easy_set("postdata_buffer", retained_body_str);
+
     curl_easy_setopt(curl, CURLOPT_POST, 1);
-    curl_easy_setopt(curl, CURLOPT_POSTFIELDS, data);
     curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, len);
-    
+#ifdef HAVE_CURLOPT_COPYPOSTFIELDS
+    curl_easy_setopt(curl, CURLOPT_COPYPOSTFIELDS, data);
+#else
+    curl_easy_setopt(curl, CURLOPT_POSTFIELDS, data);
+#endif
+
     return post_body;
   }
-  
+
   return Qnil;
 }
 
+static VALUE ruby_curl_easy_post_body_set_with_mode(VALUE self, VALUE post_body, int force_http_get_on_nil) {
+  ruby_curl_easy *rbce;
+  struct post_body_set_args args = { self, post_body, force_http_get_on_nil };
+
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
+  ruby_curl_easy_enter_native(rbce);
+
+  return rb_ensure(ruby_curl_easy_post_body_set_with_mode_body, (VALUE)&args,
+                   ruby_curl_easy_leave_native, (VALUE)rbce);
+}
+
+static VALUE ruby_curl_easy_post_body_set(VALUE self, VALUE post_body) {
+  return ruby_curl_easy_post_body_set_with_mode(self, post_body, 1);
+}
+
 /*
  * call-seq:
  *   easy.post_body                                  => string or nil
@@ -748,7 +2143,7 @@ static VALUE ruby_curl_easy_post_body_get(VALUE self) {
 /*
  * call-seq:
  *   easy.put_data = data                             => ""
- * 
+ *
  * Points this Curl::Easy instance to data to be uploaded via PUT.  This
  * sets the request to a PUT type request - useful if you want to PUT via
  * a multi handle.
@@ -757,26 +2152,15 @@ static VALUE ruby_curl_easy_put_data_set(VALUE self, VALUE data) {
   ruby_curl_easy *rbce;
   CURL *curl;
   VALUE upload;
+  VALUE upload_stream = data;
   VALUE headers;
+  VALUE infile_size = Qnil;
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
-
-  upload = ruby_curl_upload_new(cCurlUpload);
-  ruby_curl_upload_stream_set(upload,data);
-
-  curl = rbce->curl;
-  rb_easy_set("upload", upload); /* keep the upload object alive as long as
-                                    the easy handle is active or until the upload
-                                    is complete or terminated... */
-
-  curl_easy_setopt(curl, CURLOPT_NOBODY, 0);
-  curl_easy_setopt(curl, CURLOPT_UPLOAD, 1);
-  curl_easy_setopt(curl, CURLOPT_READFUNCTION, (curl_read_callback)read_data_handler);
-  curl_easy_setopt(curl, CURLOPT_READDATA, rbce);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
 
-  /* 
-   * we need to set specific headers for the PUT to work... so
-   * convert the internal headers structure to a HASH if one is set
+  /*
+   * Validate and prepare Ruby-visible state before mutating the CURL handle.
+   * Several branches below can raise (header type, stat, size, to_s).
    */
   if (!rb_easy_nil("headers")) {
     if (rb_easy_type_check("headers", T_ARRAY) || rb_easy_type_check("headers", T_STRING)) {
@@ -784,43 +2168,80 @@ static VALUE ruby_curl_easy_put_data_set(VALUE self, VALUE data) {
     }
   }
 
-  // exit fast if the payload is empty
-  if (NIL_P(data)) { return data; }
+  if (!NIL_P(data) && !rb_respond_to(data, rb_intern("read"))) {
+    if (rb_respond_to(data, rb_intern("to_s"))) {
+      upload_stream = rb_obj_as_string(data);
+    } else {
+      rb_raise(rb_eRuntimeError, "PUT data must respond to read or to_s");
+    }
+  }
 
   headers = rb_easy_get("headers");
-  if( headers == Qnil ) { 
+  if( headers == Qnil ) {
     headers = rb_hash_new();
   }
 
-  if (rb_respond_to(data, rb_intern("read"))) {
-    VALUE stat = rb_funcall(data, rb_intern("stat"), 0);
-    if( stat && rb_hash_aref(headers, rb_str_new2("Content-Length")) == Qnil) {
+  if (!NIL_P(data) && rb_respond_to(data, rb_intern("read"))) {
+    VALUE stat = Qnil;
+    if (rb_respond_to(data, rb_intern("stat"))) {
+      stat = rb_funcall(data, rb_intern("stat"), 0);
+    }
+    if(!NIL_P(stat) && stat != Qfalse && rb_hash_aref(headers, rb_str_new2("Content-Length")) == Qnil) {
       VALUE size;
       if( rb_hash_aref(headers, rb_str_new2("Expect")) == Qnil ) {
         rb_hash_aset(headers, rb_str_new2("Expect"), rb_str_new2(""));
       }
       size = rb_funcall(stat, rb_intern("size"), 0);
-      curl_easy_setopt(curl, CURLOPT_INFILESIZE, FIX2LONG(size));
+      infile_size = size;
     }
     else if( rb_hash_aref(headers, rb_str_new2("Content-Length")) == Qnil && rb_hash_aref(headers, rb_str_new2("Transfer-Encoding")) == Qnil ) {
       rb_hash_aset(headers, rb_str_new2("Transfer-Encoding"), rb_str_new2("chunked"));
     }
     else if( rb_hash_aref(headers, rb_str_new2("Content-Length")) ) {
       VALUE size = rb_funcall(rb_hash_aref(headers, rb_str_new2("Content-Length")), rb_intern("to_i"), 0);
-      curl_easy_setopt(curl, CURLOPT_INFILESIZE, FIX2LONG(size));
+      infile_size = size;
     }
   }
-  else if (rb_respond_to(data, rb_intern("to_s"))) {
-    curl_easy_setopt(curl, CURLOPT_INFILESIZE, RSTRING_LEN(data));
+  else if (!NIL_P(data) && rb_respond_to(data, rb_intern("to_s"))) {
+    infile_size = LONG2NUM(RSTRING_LEN(upload_stream));
     if( rb_hash_aref(headers, rb_str_new2("Expect")) == Qnil ) {
       rb_hash_aset(headers, rb_str_new2("Expect"), rb_str_new2(""));
     }
   }
+  else if (NIL_P(data)) {
+    /* Preserve legacy nil handling: configure an upload with no payload. */
+  }
   else {
     rb_raise(rb_eRuntimeError, "PUT data must respond to read or to_s");
   }
   rb_easy_set("headers",headers);
 
+  upload = ruby_curl_upload_new(cCurlUpload);
+  ruby_curl_upload_stream_set(upload, upload_stream);
+
+  curl = rbce->curl;
+  rb_easy_set("upload", upload); /* keep the upload object alive as long as
+                                    the easy handle is active or until the upload
+                                    is complete or terminated... */
+
+  curl_easy_setopt(curl, CURLOPT_NOBODY, 0);
+  curl_easy_setopt(curl, CURLOPT_POST, 0);
+  curl_easy_setopt(curl, CURLOPT_POSTFIELDS, NULL);
+  curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, 0);
+  curl_easy_setopt(curl, CURLOPT_UPLOAD, 1);
+  curl_easy_setopt(curl, CURLOPT_READFUNCTION, (curl_read_callback)read_data_handler);
+#ifdef HAVE_CURLOPT_SEEKFUNCTION
+  curl_easy_setopt(curl, CURLOPT_SEEKFUNCTION, (curl_seek_callback)seek_data_handler);
+#endif
+  curl_easy_setopt(curl, CURLOPT_READDATA, rbce);
+#ifdef HAVE_CURLOPT_SEEKDATA
+  curl_easy_setopt(curl, CURLOPT_SEEKDATA, rbce);
+#endif
+
+  if (!NIL_P(infile_size)) {
+    curl_easy_setopt(curl, CURLOPT_INFILESIZE, NUM2LONG(infile_size));
+  }
+
   // if we made it this far, all should be well.
   return data;
 }
@@ -829,20 +2250,188 @@ static VALUE ruby_curl_easy_put_data_set(VALUE self, VALUE data) {
  * call-seq:
  *   easy.ftp_commands = ["CWD /", "MKD directory"]   => ["CWD /", ...]
  *
- * Explicitly sets the list of commands to execute on the FTP server when calling perform
+ * Explicitly sets the list of commands to execute on the FTP server when calling perform.
+ *
+ * NOTE:
+ * - This maps to libcurl CURLOPT_QUOTE; it sends commands on the control connection.
+ * - Do not include data-transfer commands like LIST/NLST/RETR/STOR here. libcurl does not
+ *   parse PASV/EPSV replies from QUOTE commands and will not establish the required data
+ *   connection. For directory listings, set CURLOPT_DIRLISTONLY (via `easy.set(:dirlistonly, true)`)
+ *   and request an FTP directory URL (e.g. "ftp://host/path/") so libcurl manages PASV/EPSV
+ *   and the data connection for you.
  */
 static VALUE ruby_curl_easy_ftp_commands_set(VALUE self, VALUE ftp_commands) {
   CURB_OBJECT_HSETTER(ruby_curl_easy, ftp_commands);
 }
 
 /*
- * call-seq
+ * call-seq:
  *   easy.ftp_commands                                => array or nil
  */
 static VALUE ruby_curl_easy_ftp_commands_get(VALUE self) {
   CURB_OBJECT_HGETTER(ruby_curl_easy, ftp_commands);
 }
 
+/*
+ * call-seq:
+ *   easy.resolve = [ "example.com:80:127.0.0.1" ]   => [ "example.com:80:127.0.0.1" ]
+ *
+ * Set the resolve list to statically resolve hostnames to IP addresses,
+ * bypassing DNS for matching hostname/port combinations.
+ */
+static VALUE ruby_curl_easy_resolve_set(VALUE self, VALUE resolve) {
+  CURB_OBJECT_HSETTER(ruby_curl_easy, resolve);
+}
+
+/*
+ * call-seq:
+ *   easy.resolve                                => array or nil
+ */
+static VALUE ruby_curl_easy_resolve_get(VALUE self) {
+  CURB_OBJECT_HGETTER(ruby_curl_easy, resolve);
+}
+
+/*
+ * call-seq:
+ *   easy.connect_to = [ "example.com:80:127.0.0.1:80" ]   => [ "example.com:80:127.0.0.1:80" ]
+ *
+ * Set the connect-to list to redirect matching request host/port pairs to
+ * alternate connection host/port pairs.
+ */
+static VALUE ruby_curl_easy_connect_to_set(VALUE self, VALUE connect_to) {
+  CURB_OBJECT_HSETTER(ruby_curl_easy, connect_to);
+}
+
+/*
+ * call-seq:
+ *   easy.connect_to                                => array or nil
+ */
+static VALUE ruby_curl_easy_connect_to_get(VALUE self) {
+  CURB_OBJECT_HGETTER(ruby_curl_easy, connect_to);
+}
+
+/*
+ * call-seq:
+ *   easy.doh_url = "https://dns.example/dns-query"       => "https://dns.example/dns-query"
+ *
+ * Set the DNS-over-HTTPS URL to use for resolving hostnames.
+ */
+static VALUE ruby_curl_easy_doh_url_set(VALUE self, VALUE doh_url) {
+  CURB_OBJECT_HSETTER(ruby_curl_easy, doh_url);
+}
+
+/*
+ * call-seq:
+ *   easy.doh_url                                => string or nil
+ */
+static VALUE ruby_curl_easy_doh_url_get(VALUE self) {
+  CURB_OBJECT_HGETTER(ruby_curl_easy, doh_url);
+}
+
+#ifdef HAVE_CURLOPT_DNS_SERVERS
+/*
+ * call-seq:
+ *   easy.dns_servers                                => string or nil
+ */
+static VALUE ruby_curl_easy_dns_servers_get(VALUE self) {
+  CURB_OBJECT_HGETTER(ruby_curl_easy, dns_servers);
+}
+#endif
+
+static VALUE ruby_curl_easy_allow_unix_socket_set(VALUE self, VALUE allow) {
+  ruby_curl_easy *rbce;
+
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
+  rbce->allow_unix_socket = RTEST(allow) ? 1 : 0;
+
+  return allow;
+}
+
+static VALUE ruby_curl_easy_allow_proxy_set(VALUE self, VALUE allow) {
+  ruby_curl_easy *rbce;
+
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
+  rbce->allow_proxy = RTEST(allow) ? 1 : 0;
+
+  return allow;
+}
+
+/*
+ * call-seq:
+ *   easy.allowed_cidrs = ["203.0.113.0/24"]          => ["203.0.113.0/24"]
+ *
+ * Set resolved-peer CIDR ranges that are allowed when network_policy is :public.
+ * Private/local unsafe ranges are still blocked before this allowlist is
+ * evaluated.
+ */
+static VALUE ruby_curl_easy_allowed_cidrs_set(VALUE self, VALUE cidrs) {
+  ruby_curl_easy *rbce;
+  VALUE normalized;
+  VALUE stored;
+
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
+  normalized = curb_normalize_cidr_list(cidrs);
+  stored = curb_dup_string_array(normalized);
+  rb_hash_aset(rbce->opts, rb_easy_hkey("allowed_cidrs"), stored);
+  if (rbce->network_policy == CURB_NETWORK_POLICY_PUBLIC) {
+    curb_prepare_network_allowed_cidr_rules(rbce);
+  } else {
+    curb_clear_network_allowed_cidr_rules(rbce);
+  }
+
+  return curb_dup_string_array(stored);
+}
+
+/*
+ * call-seq:
+ *   easy.allowed_cidrs                                => array or nil
+ */
+static VALUE ruby_curl_easy_allowed_cidrs_get(VALUE self) {
+  ruby_curl_easy *rbce;
+  VALUE cidrs;
+
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
+  cidrs = rb_hash_aref(rbce->opts, rb_easy_hkey("allowed_cidrs"));
+
+  return curb_dup_string_array(cidrs);
+}
+
+/*
+ * call-seq:
+ *   easy.allowed_hosts = ["api.example.com"]          => ["api.example.com"]
+ *
+ * Set URL hosts allowed for this handle. When libcurl supports
+ * CURLOPT_PREREQFUNCTION, this is checked before each request, including
+ * followed redirects.
+ */
+static VALUE ruby_curl_easy_allowed_hosts_set(VALUE self, VALUE hosts) {
+  ruby_curl_easy *rbce;
+  VALUE normalized;
+  VALUE stored;
+
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
+  normalized = curb_normalize_host_list(hosts);
+  stored = curb_dup_string_array(normalized);
+  rb_hash_aset(rbce->opts, rb_easy_hkey("allowed_hosts"), stored);
+  curb_prepare_network_allowed_hosts(rbce);
+
+  return curb_dup_string_array(stored);
+}
+
+/*
+ * call-seq:
+ *   easy.allowed_hosts                                => array or nil
+ */
+static VALUE ruby_curl_easy_allowed_hosts_get(VALUE self) {
+  ruby_curl_easy *rbce;
+  VALUE hosts;
+
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
+  hosts = rb_hash_aref(rbce->opts, rb_easy_hkey("allowed_hosts"));
+
+  return curb_dup_string_array(hosts);
+}
+
 /* ================== IMMED ATTRS ==================*/
 
 /*
@@ -951,16 +2540,16 @@ static VALUE ruby_curl_easy_proxy_type_get(VALUE self) {
   (!strncmp("digest",node,6)) ? CURLAUTH_DIGEST : \
   (!strncmp("gssnegotiate",node,12)) ? CURLAUTH_GSSNEGOTIATE : \
   (!strncmp("ntlm",node,4)) ? CURLAUTH_NTLM : \
-  (!strncmp("any",node,3)) ? CURLAUTH_ANY : \
-  (!strncmp("anysafe",node,7)) ? CURLAUTH_ANYSAFE : 0
-#else 
+  (!strncmp("anysafe",node,7)) ? CURLAUTH_ANYSAFE : \
+  (!strncmp("any",node,3)) ? CURLAUTH_ANY : 0
+#else
 #define CURL_HTTPAUTH_STR_TO_NUM(node) \
   (!strncmp("basic",node,5)) ? CURLAUTH_BASIC : \
   (!strncmp("digest",node,6)) ? CURLAUTH_DIGEST : \
   (!strncmp("gssnegotiate",node,12)) ? CURLAUTH_GSSNEGOTIATE : \
   (!strncmp("ntlm",node,4)) ? CURLAUTH_NTLM : \
-  (!strncmp("any",node,3)) ? CURLAUTH_ANY : \
-  (!strncmp("anysafe",node,7)) ? CURLAUTH_ANYSAFE : 0
+  (!strncmp("anysafe",node,7)) ? CURLAUTH_ANYSAFE : \
+  (!strncmp("any",node,3)) ? CURLAUTH_ANY : 0
 #endif
 /*
  * call-seq:
@@ -974,21 +2563,22 @@ static VALUE ruby_curl_easy_proxy_type_get(VALUE self) {
 static VALUE ruby_curl_easy_http_auth_types_set(int argc, VALUE *argv, VALUE self) {//VALUE self, VALUE http_auth_types) {
   ruby_curl_easy *rbce;
   VALUE args_ary;
-  int i, len;
+  long i, len;
   char* node = NULL;
-  long mask = 0x000000;
+  long mask = 0;
 
   rb_scan_args(argc, argv, "*", &args_ary);
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
 
-  len = (int)RARRAY_LEN(args_ary);
+  len = RARRAY_LEN(args_ary);
 
-  if (len == 1 && (TYPE(rb_ary_entry(args_ary,0)) == T_FIXNUM || rb_ary_entry(args_ary,0) == Qnil)) {
-    if (rb_ary_entry(args_ary,0) == Qnil) { 
+  if (len == 1 && (rb_ary_entry(args_ary,0) == Qnil || TYPE(rb_ary_entry(args_ary,0)) == T_FIXNUM ||
+        TYPE(rb_ary_entry(args_ary,0)) == T_BIGNUM)) {
+    if (rb_ary_entry(args_ary,0) == Qnil) {
       rbce->http_auth_types = 0;
     }
     else {
-      rbce->http_auth_types = NUM2INT(rb_ary_entry(args_ary,0));
+      rbce->http_auth_types = NUM2LONG(rb_ary_entry(args_ary,0));
     }
   }
   else {
@@ -1001,7 +2591,7 @@ static VALUE ruby_curl_easy_http_auth_types_set(int argc, VALUE *argv, VALUE sel
     }
     rbce->http_auth_types = mask;
   }
-  return INT2NUM(rbce->http_auth_types);
+  return LONG2NUM(rbce->http_auth_types);
 }
 
 /*
@@ -1066,7 +2656,7 @@ static VALUE ruby_curl_easy_max_redirects_get(VALUE self) {
 
 /*
  * call-seq:
- *   easy.timeout = fixnum or nil                     => fixnum or nil
+ *   easy.timeout = float, fixnum or nil              => numeric
  *
  * Set the maximum time in seconds that you allow the libcurl transfer
  * operation to take. Normally, name lookups can take a considerable time
@@ -1075,20 +2665,77 @@ static VALUE ruby_curl_easy_max_redirects_get(VALUE self) {
  *
  * Set to nil (or zero) to disable timeout (it will then only timeout
  * on the system's internal timeouts).
+ *
+ * Uses timeout_ms internally instead of timeout because it allows for
+ * better precision and libcurl will use the last set value when both
+ * timeout and timeout_ms are set.
+ *
  */
-static VALUE ruby_curl_easy_timeout_set(VALUE self, VALUE timeout) {
-  CURB_IMMED_SETTER(ruby_curl_easy, timeout, 0);
+static VALUE ruby_curl_easy_timeout_set(VALUE self, VALUE timeout_s) {
+  ruby_curl_easy *rbce;
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
+
+  if (Qnil == timeout_s || NUM2DBL(timeout_s) <= 0.0) {
+    rbce->timeout_ms = 0;
+  } else {
+    rbce->timeout_ms = (unsigned long)(NUM2DBL(timeout_s) * 1000);
+  }
+
+  return DBL2NUM(rbce->timeout_ms / 1000.0);
 }
 
 /*
  * call-seq:
- *   easy.timeout                                     => fixnum or nil
+ *   easy.timeout                                     => numeric
  *
  * Obtain the maximum time in seconds that you allow the libcurl transfer
  * operation to take.
+ *
+ * Uses timeout_ms internally instead of timeout.
+ *
+ */
+static VALUE ruby_curl_easy_timeout_get(VALUE self) {
+  ruby_curl_easy *rbce;
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
+  return DBL2NUM(rbce->timeout_ms / 1000.0);
+}
+
+/*
+ * call-seq:
+ *   easy.timeout_ms = fixnum or nil                  => fixnum or nil
+ *
+ * Set the maximum time in milliseconds that you allow the libcurl transfer
+ * operation to take. Normally, name lookups can take a considerable time
+ * and limiting operations to less than a few minutes risk aborting
+ * perfectly normal operations.
+ *
+ * Set to nil (or zero) to disable timeout (it will then only timeout
+ * on the system's internal timeouts).
+ */
+static VALUE ruby_curl_easy_timeout_ms_set(VALUE self, VALUE timeout_ms) {
+  ruby_curl_easy *rbce;
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
+
+  if (Qnil == timeout_ms || NUM2DBL(timeout_ms) <= 0.0) {
+    rbce->timeout_ms = 0;
+  } else {
+    rbce->timeout_ms = NUM2ULONG(timeout_ms);
+  }
+
+  return ULONG2NUM(rbce->timeout_ms);
+}
+
+/*
+ * call-seq:
+ *   easy.timeout_ms                                  => fixnum or nil
+ *
+ * Obtain the maximum time in milliseconds that you allow the libcurl transfer
+ * operation to take.
  */
-static VALUE ruby_curl_easy_timeout_get(VALUE self, VALUE timeout) {
-  CURB_IMMED_GETTER(ruby_curl_easy, timeout, 0);
+static VALUE ruby_curl_easy_timeout_ms_get(VALUE self) {
+  ruby_curl_easy *rbce;
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
+  return LONG2NUM(rbce->timeout_ms);
 }
 
 /*
@@ -1113,10 +2760,36 @@ static VALUE ruby_curl_easy_connect_timeout_set(VALUE self, VALUE connect_timeou
  * Obtain the maximum time in seconds that you allow the connection to the
  * server to take.
  */
-static VALUE ruby_curl_easy_connect_timeout_get(VALUE self, VALUE connect_timeout) {
+static VALUE ruby_curl_easy_connect_timeout_get(VALUE self) {
   CURB_IMMED_GETTER(ruby_curl_easy, connect_timeout, 0);
 }
 
+/*
+ * call-seq:
+ *   easy.connect_timeout_ms = fixnum or nil          => fixnum or nil
+ *
+ * Set the maximum time in milliseconds that you allow the connection to the
+ * server to take. This only limits the connection phase, once it has
+ * connected, this option is of no more use.
+ *
+ * Set to nil (or zero) to disable connection timeout (it will then only
+ * timeout on the system's internal timeouts).
+ */
+static VALUE ruby_curl_easy_connect_timeout_ms_set(VALUE self, VALUE connect_timeout_ms) {
+  CURB_IMMED_SETTER(ruby_curl_easy, connect_timeout_ms, 0);
+}
+
+/*
+ * call-seq:
+ *   easy.connect_timeout_ms                          => fixnum or nil
+ *
+ * Obtain the maximum time in milliseconds that you allow the connection to the
+ * server to take.
+ */
+static VALUE ruby_curl_easy_connect_timeout_ms_get(VALUE self) {
+  CURB_IMMED_GETTER(ruby_curl_easy, connect_timeout_ms, 0);
+}
+
 /*
  * call-seq:
  *   easy.dns_cache_timeout = fixnum or nil           => fixnum or nil
@@ -1136,7 +2809,7 @@ static VALUE ruby_curl_easy_dns_cache_timeout_set(VALUE self, VALUE dns_cache_ti
  *
  * Obtain the dns cache timeout in seconds.
  */
-static VALUE ruby_curl_easy_dns_cache_timeout_get(VALUE self, VALUE dns_cache_timeout) {
+static VALUE ruby_curl_easy_dns_cache_timeout_get(VALUE self) {
   CURB_IMMED_GETTER(ruby_curl_easy, dns_cache_timeout, -1);
 }
 
@@ -1163,7 +2836,7 @@ static VALUE ruby_curl_easy_ftp_response_timeout_set(VALUE self, VALUE ftp_respo
  *
  * Obtain the maximum time that libcurl will wait for FTP command responses.
  */
-static VALUE ruby_curl_easy_ftp_response_timeout_get(VALUE self, VALUE ftp_response_timeout) {
+static VALUE ruby_curl_easy_ftp_response_timeout_get(VALUE self) {
   CURB_IMMED_GETTER(ruby_curl_easy, ftp_response_timeout, 0);
 }
 
@@ -1186,7 +2859,7 @@ static VALUE ruby_curl_easy_low_speed_limit_set(VALUE self, VALUE low_speed_limi
  * Obtain the minimum transfer speed over +low_speed+time+ below which the
  * transfer will be aborted.
  */
-static VALUE ruby_curl_easy_low_speed_limit_get(VALUE self, VALUE low_speed_limit) {
+static VALUE ruby_curl_easy_low_speed_limit_get(VALUE self) {
   CURB_IMMED_GETTER(ruby_curl_easy, low_speed_limit, 0);
 }
 
@@ -1208,10 +2881,50 @@ static VALUE ruby_curl_easy_low_speed_time_set(VALUE self, VALUE low_speed_time)
  * Obtain the time that the transfer should be below +low_speed_limit+ for
  * the library to abort it.
  */
-static VALUE ruby_curl_easy_low_speed_time_get(VALUE self, VALUE low_speed_time) {
+static VALUE ruby_curl_easy_low_speed_time_get(VALUE self) {
   CURB_IMMED_GETTER(ruby_curl_easy, low_speed_time, 0);
 }
 
+/*
+ * call-seq:
+ *   easy.max_send_speed_large = fixnum or nil        => fixnum or nil
+ *
+ * Set the maximal sending transfer speed (in bytes per second) 
+ */
+static VALUE ruby_curl_easy_max_send_speed_large_set(VALUE self, VALUE max_send_speed_large) {
+  CURB_IMMED_SETTER(ruby_curl_easy, max_send_speed_large, 0);
+}
+
+/*
+ * call-seq:
+ *   easy.max_send_speed_large = fixnum or nil        => fixnum or nil
+ *
+ * Get the maximal sending transfer speed (in bytes per second) 
+ */
+static VALUE ruby_curl_easy_max_send_speed_large_get(VALUE self) {
+  CURB_IMMED_GETTER(ruby_curl_easy, max_send_speed_large, 0);
+}
+
+/*
+ * call-seq:
+ *   easy.max_recv_speed_large = fixnum or nil        => fixnum or nil
+ *
+ * Set the maximal receiving transfer speed (in bytes per second) 
+ */
+static VALUE ruby_curl_easy_max_recv_speed_large_set(VALUE self, VALUE max_recv_speed_large) {
+  CURB_IMMED_SETTER(ruby_curl_easy, max_recv_speed_large, 0);
+}
+
+/*
+ * call-seq:
+ *   easy.max_recv_speed_large = fixnum or nil        => fixnum or nil
+ *
+ * Get the maximal receiving transfer speed (in bytes per second) 
+ */
+static VALUE ruby_curl_easy_max_recv_speed_large_get(VALUE self) {
+  CURB_IMMED_GETTER(ruby_curl_easy, max_recv_speed_large, 0);
+}
+
 /*
  * call-seq:
  *   easy.username = string                           => string
@@ -1219,7 +2932,7 @@ static VALUE ruby_curl_easy_low_speed_time_get(VALUE self, VALUE low_speed_time)
  * Set the HTTP Authentication username.
  */
 static VALUE ruby_curl_easy_username_set(VALUE self, VALUE username) {
-#if HAVE_CURLOPT_USERNAME
+#ifdef HAVE_CURLOPT_USERNAME
   CURB_OBJECT_HSETTER(ruby_curl_easy, username);
 #else
   return Qnil;
@@ -1229,11 +2942,11 @@ static VALUE ruby_curl_easy_username_set(VALUE self, VALUE username) {
 /*
  * call-seq:
  *   easy.username                                    => string
- * 
+ *
  * Get the current username
  */
-static VALUE ruby_curl_easy_username_get(VALUE self, VALUE username) {
-#if HAVE_CURLOPT_USERNAME
+static VALUE ruby_curl_easy_username_get(VALUE self) {
+#ifdef HAVE_CURLOPT_USERNAME
   CURB_OBJECT_HGETTER(ruby_curl_easy, username);
 #else
   return Qnil;
@@ -1247,7 +2960,7 @@ static VALUE ruby_curl_easy_username_get(VALUE self, VALUE username) {
  * Set the HTTP Authentication password.
  */
 static VALUE ruby_curl_easy_password_set(VALUE self, VALUE password) {
-#if HAVE_CURLOPT_PASSWORD
+#ifdef HAVE_CURLOPT_PASSWORD
   CURB_OBJECT_HSETTER(ruby_curl_easy, password);
 #else
   return Qnil;
@@ -1257,11 +2970,11 @@ static VALUE ruby_curl_easy_password_set(VALUE self, VALUE password) {
 /*
  * call-seq:
  *   easy.password                                    => string
- * 
+ *
  * Get the current password
  */
-static VALUE ruby_curl_easy_password_get(VALUE self, VALUE password) {
-#if HAVE_CURLOPT_PASSWORD
+static VALUE ruby_curl_easy_password_get(VALUE self) {
+#ifdef HAVE_CURLOPT_PASSWORD
   CURB_OBJECT_HGETTER(ruby_curl_easy, password);
 #else
   return Qnil;
@@ -1273,8 +2986,16 @@ static VALUE ruby_curl_easy_password_get(VALUE self, VALUE password) {
  *   easy.ssl_version = value                         => fixnum or nil
  *
  * Sets the version of SSL/TLS that libcurl will attempt to use. Valid
- * options are Curl::CURL_SSLVERSION_TLSv1, Curl::CURL_SSLVERSION::SSLv2,
- * Curl::CURL_SSLVERSION_SSLv3 and Curl::CURL_SSLVERSION_DEFAULT
+ * options are:
+ *
+ *   Curl::CURL_SSLVERSION_DEFAULT
+ *   Curl::CURL_SSLVERSION_TLSv1 (TLS 1.x)
+ *   Curl::CURL_SSLVERSION_SSLv2
+ *   Curl::CURL_SSLVERSION_SSLv3
+ *   Curl::CURL_SSLVERSION_TLSv1_0
+ *   Curl::CURL_SSLVERSION_TLSv1_1
+ *   Curl::CURL_SSLVERSION_TLSv1_2
+ *   Curl::CURL_SSLVERSION_TLSv1_3
  */
 static VALUE ruby_curl_easy_ssl_version_set(VALUE self, VALUE ssl_version) {
   CURB_IMMED_SETTER(ruby_curl_easy, ssl_version, -1);
@@ -1286,14 +3007,14 @@ static VALUE ruby_curl_easy_ssl_version_set(VALUE self, VALUE ssl_version) {
  *
  * Get the version of SSL/TLS that libcurl will attempt to use.
  */
-static VALUE ruby_curl_easy_ssl_version_get(VALUE self, VALUE ssl_version) {
+static VALUE ruby_curl_easy_ssl_version_get(VALUE self) {
   CURB_IMMED_GETTER(ruby_curl_easy, ssl_version, -1);
 }
 
 /*
  * call-seq:
  *   easy.use_ssl = value                             => fixnum or nil
- * 
+ *
  * Ensure libcurl uses SSL for FTP connections. Valid options are Curl::CURL_USESSL_NONE,
  * Curl::CURL_USESSL_TRY, Curl::CURL_USESSL_CONTROL, and Curl::CURL_USESSL_ALL.
  */
@@ -1307,7 +3028,7 @@ static VALUE ruby_curl_easy_use_ssl_set(VALUE self, VALUE use_ssl) {
  *
  * Get the desired level for using SSL on FTP connections.
  */
-static VALUE ruby_curl_easy_use_ssl_get(VALUE self, VALUE use_ssl) {
+static VALUE ruby_curl_easy_use_ssl_get(VALUE self) {
   CURB_IMMED_GETTER(ruby_curl_easy, use_ssl, -1);
 }
 
@@ -1323,12 +3044,12 @@ static VALUE ruby_curl_easy_ftp_filemethod_set(VALUE self, VALUE ftp_filemethod)
 }
 
 /*
- * call-seq
+ * call-seq:
  *   easy.ftp_filemethod                              => fixnum
  *
  * Get the configuration for how libcurl will reach files on the server.
  */
-static VALUE ruby_curl_easy_ftp_filemethod_get(VALUE self, VALUE ftp_filemethod) {
+static VALUE ruby_curl_easy_ftp_filemethod_get(VALUE self) {
   CURB_IMMED_GETTER(ruby_curl_easy, ftp_filemethod, -1);
 }
 
@@ -1486,7 +3207,7 @@ static VALUE ruby_curl_easy_use_netrc_q(VALUE self) {
  */
 static VALUE ruby_curl_easy_autoreferer_set(VALUE self, VALUE autoreferer) {
   ruby_curl_easy *rbce;
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
 
   if (Qtrue == autoreferer) {
     curl_easy_setopt(rbce->curl, CURLOPT_AUTOREFERER, 1);
@@ -1587,7 +3308,12 @@ static VALUE ruby_curl_easy_multipart_form_post_q(VALUE self) {
  *   easy.enable_cookies = boolean                    => boolean
  *
  * Configure whether the libcurl cookie engine is enabled for this Curl::Easy
- * instance.
+ * instance. When enabled, cookies received via Set-Cookie are stored by libcurl
+ * and automatically sent on subsequent matching requests. Use +easy.cookiefile+
+ * to load cookies and +easy.cookiejar+ to persist them.
+ *
+ * This setting is independent from the manual Cookie header set via +easy.cookies+.
+ * The manual header is additive and can be cleared by assigning an empty string.
  */
 static VALUE ruby_curl_easy_enable_cookies_set(VALUE self, VALUE enable_cookies)
 {
@@ -1637,9 +3363,10 @@ static VALUE ruby_curl_easy_ignore_content_length_q(VALUE self) {
  */
 static VALUE ruby_curl_easy_resolve_mode(VALUE self) {
   ruby_curl_easy *rbce;
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+  unsigned short rm;
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
 
-  unsigned short rm = rbce->resolve_mode;
+  rm = rbce->resolve_mode;
 
   switch(rm) {
     case CURL_IPRESOLVE_V4:
@@ -1668,9 +3395,10 @@ static VALUE ruby_curl_easy_resolve_mode_set(VALUE self, VALUE resolve_mode) {
     return Qnil;
   } else {
     ruby_curl_easy *rbce;
-    Data_Get_Struct(self, ruby_curl_easy, rbce);
+    ID resolve_mode_id;
+    TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
 
-    ID resolve_mode_id = rb_to_id(resolve_mode);
+    resolve_mode_id = rb_to_id(resolve_mode);
 
     if (resolve_mode_id == rb_intern("auto")) {
       rbce->resolve_mode = CURL_IPRESOLVE_WHATEVER;
@@ -1688,12 +3416,147 @@ static VALUE ruby_curl_easy_resolve_mode_set(VALUE self, VALUE resolve_mode) {
   }
 }
 
+/*
+ * call-seq:
+ *   easy.network_policy                                      => symbol
+ *
+ * Determine which native network policy will be enforced when libcurl opens
+ * sockets for this handle.
+ */
+static VALUE ruby_curl_easy_network_policy_get(VALUE self) {
+  ruby_curl_easy *rbce;
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
+
+  switch (rbce->network_policy) {
+  case CURB_NETWORK_POLICY_PUBLIC:
+    return ID2SYM(idNetworkPolicyPublic);
+  case CURB_NETWORK_POLICY_NONE:
+  default:
+    return ID2SYM(idNetworkPolicyNone);
+  }
+}
+
+/*
+ * call-seq:
+ *   easy.network_policy = symbol                             => symbol
+ *
+ * Supported values:
+ * [:none]    disables native destination checks.
+ * [:public]  blocks loopback, private, link-local, multicast,
+ *            unspecified, metadata, and other non-public addresses.
+ */
+static VALUE ruby_curl_easy_network_policy_set(VALUE self, VALUE network_policy) {
+  ruby_curl_easy *rbce;
+  ID network_policy_id;
+
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
+
+  if (NIL_P(network_policy)) {
+    rbce->network_policy = CURB_NETWORK_POLICY_NONE;
+    return ID2SYM(idNetworkPolicyNone);
+  }
+
+  if (TYPE(network_policy) != T_SYMBOL) {
+    rb_raise(rb_eTypeError, "network_policy must be a Symbol");
+  }
+
+  network_policy_id = rb_to_id(network_policy);
+
+  if (network_policy_id == idNetworkPolicyNone) {
+    rbce->network_policy = CURB_NETWORK_POLICY_NONE;
+    rbce->allow_proxy = 0;
+    return network_policy;
+  } else if (network_policy_id == idNetworkPolicyPublic) {
+#ifndef CURB_HAVE_OPENSOCKET_NETWORK_POLICY
+    rb_raise(rb_eNotImpError, "network_policy=:public requires CURLOPT_OPENSOCKETFUNCTION support");
+#else
+    rbce->network_policy = CURB_NETWORK_POLICY_PUBLIC;
+    rbce->allow_proxy = 0;
+    return network_policy;
+#endif
+  }
+
+  rb_raise(rb_eArgError, "network_policy must be one of :none, :public");
+}
+
+/*
+ * call-seq:
+ *   easy.unsafe_destination_error                             => string or nil
+ *
+ * Return the native network policy block reason from the most recent transfer.
+ */
+static VALUE ruby_curl_easy_unsafe_destination_error_get(VALUE self) {
+  ruby_curl_easy *rbce;
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
+
+  if (rbce->unsafe_destination_blocked && rbce->unsafe_destination_error[0]) {
+    return rb_str_new2(rbce->unsafe_destination_error);
+  }
+
+  return Qnil;
+}
+
+#ifdef HAVE_CURLOPT_UNIX_SOCKET_PATH
+/*
+ * call-seq:
+ *   easy.unix_socket_path                             => string or nil
+ *
+ * Return the configured Unix socket path, if set through CURLOPT_UNIX_SOCKET_PATH.
+ */
+static VALUE ruby_curl_easy_unix_socket_path_get(VALUE self) {
+  ruby_curl_easy *rbce;
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
+
+  return rb_easy_get("unix_socket_path");
+}
+#endif
+
+/*
+ * call-seq:
+ *   easy.http_version = Curl::HTTP_1_1               => Curl::HTTP_1_1
+ *
+ * Force libcurl to use a specific HTTP protocol version. By default libcurl
+ * negotiates the highest version supported by both peers. Supported constants
+ * include Curl::HTTP_NONE, Curl::HTTP_1_0, Curl::HTTP_1_1, Curl::HTTP_2_0,
+ * Curl::HTTP_2TLS, and Curl::HTTP_2_PRIOR_KNOWLEDGE (when provided by libcurl).
+ */
+static VALUE ruby_curl_easy_http_version_set(VALUE self, VALUE version) {
+  ruby_curl_easy *rbce;
+  long http_version;
+
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
+
+  if (NIL_P(version)) {
+    http_version = CURL_HTTP_VERSION_NONE;
+  } else {
+    http_version = NUM2LONG(version);
+  }
+
+  rbce->http_version = http_version;
+
+  return version;
+}
+
+/*
+ * call-seq:
+ *   easy.http_version                                => integer
+ *
+ * Returns the HTTP protocol version currently configured.
+ */
+static VALUE ruby_curl_easy_http_version_get(VALUE self) {
+  ruby_curl_easy *rbce;
+
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
+
+  return LONG2NUM(rbce->http_version);
+}
+
 
 /* ================= EVENT PROCS ================== */
 
 /*
  * call-seq:
- *   easy.on_body { |body_data| ... }                 => &lt;old handler&gt;
+ *   easy.on_body { |body_data| ... }                 => <old handler>
  *
  * Assign or remove the +on_body+ handler for this Curl::Easy instance.
  * To remove a previously-supplied handler, call this method with no
@@ -1712,7 +3575,7 @@ static VALUE ruby_curl_easy_on_body_set(int argc, VALUE *argv, VALUE self) {
 
 /*
  * call-seq:
- *   easy.on_success { |easy| ... }                   => &lt;old handler&gt;
+ *   easy.on_success { |easy| ... }                   => <old handler>
  *
  * Assign or remove the +on_success+ handler for this Curl::Easy instance.
  * To remove a previously-supplied handler, call this method with no
@@ -1727,7 +3590,7 @@ static VALUE ruby_curl_easy_on_success_set(int argc, VALUE *argv, VALUE self) {
 
 /*
  * call-seq:
- *   easy.on_failure {|easy,code| ... }               => &lt;old handler&gt;
+ *   easy.on_failure {|easy,code| ... }               => <old handler>
  *
  * Assign or remove the +on_failure+ handler for this Curl::Easy instance.
  * To remove a previously-supplied handler, call this method with no
@@ -1742,13 +3605,13 @@ static VALUE ruby_curl_easy_on_failure_set(int argc, VALUE *argv, VALUE self) {
 
 /*
  * call-seq:
- *  easy.on_missing {|easy,code| ... }                => &lt;old handler;&gt;
+ *  easy.on_missing {|easy,code| ... }                => <old handler;>
  *
  *  Assign or remove the on_missing handler for this Curl::Easy instance.
  *  To remove a previously-supplied handler, call this method with no attached
  *  block.
  *
- *  The +on_missing+ handler is called when request is finished with a 
+ *  The +on_missing+ handler is called when request is finished with a
  *  status of 40x
  */
 static VALUE ruby_curl_easy_on_missing_set(int argc, VALUE *argv, VALUE self) {
@@ -1757,13 +3620,13 @@ static VALUE ruby_curl_easy_on_missing_set(int argc, VALUE *argv, VALUE self) {
 
 /*
  * call-seq:
- *  easy.on_redirect {|easy,code| ... }                => &lt;old handler;&gt;
+ *  easy.on_redirect {|easy,code| ... }                => <old handler;>
  *
  *  Assign or remove the on_redirect handler for this Curl::Easy instance.
  *  To remove a previously-supplied handler, call this method with no attached
  *  block.
  *
- *  The +on_redirect+ handler is called when request is finished with a 
+ *  The +on_redirect+ handler is called when request is finished with a
  *  status of 30x
  */
 static VALUE ruby_curl_easy_on_redirect_set(int argc, VALUE *argv, VALUE self) {
@@ -1772,7 +3635,7 @@ static VALUE ruby_curl_easy_on_redirect_set(int argc, VALUE *argv, VALUE self) {
 
 /*
  * call-seq:
- *   easy.on_complete {|easy| ... }                   => &lt;old handler&gt;
+ *   easy.on_complete {|easy| ... }                   => <old handler>
  *
  * Assign or remove the +on_complete+ handler for this Curl::Easy instance.
  * To remove a previously-supplied handler, call this method with no
@@ -1786,7 +3649,7 @@ static VALUE ruby_curl_easy_on_complete_set(int argc, VALUE *argv, VALUE self) {
 
 /*
  * call-seq:
- *   easy.on_header { |header_data| ... }             => &lt;old handler&gt;
+ *   easy.on_header { |header_data| ... }             => <old handler>
  *
  * Assign or remove the +on_header+ handler for this Curl::Easy instance.
  * To remove a previously-supplied handler, call this method with no
@@ -1802,7 +3665,7 @@ static VALUE ruby_curl_easy_on_header_set(int argc, VALUE *argv, VALUE self) {
 
 /*
  * call-seq:
- *   easy.on_progress { |dl_total, dl_now, ul_total, ul_now| ... } => &lt;old handler&gt;
+ *   easy.on_progress { |dl_total, dl_now, ul_total, ul_now| ... } => <old handler>
  *
  * Assign or remove the +on_progress+ handler for this Curl::Easy instance.
  * To remove a previously-supplied handler, call this method with no
@@ -1823,7 +3686,7 @@ static VALUE ruby_curl_easy_on_progress_set(int argc, VALUE *argv, VALUE self) {
 
 /*
  * call-seq:
- *   easy.on_debug { |type, data| ... }               => &lt;old handler&gt;
+ *   easy.on_debug { |type, data| ... }               => <old handler>
  *
  * Assign or remove the +on_debug+ handler for this Curl::Easy instance.
  * To remove a previously-supplied handler, call this method with no
@@ -1848,12 +3711,12 @@ static VALUE ruby_curl_easy_on_debug_set(int argc, VALUE *argv, VALUE self) {
 /***********************************************
  * This is an rb_iterate callback used to set up http headers.
  */
-static VALUE cb_each_http_header(VALUE header, VALUE wrap) {
+static VALUE cb_each_http_header(VALUE header, VALUE wrap, int _c, const VALUE *_ptr, VALUE unused) {
   struct curl_slist **list;
-  Data_Get_Struct(wrap, struct curl_slist *, list);
-
   VALUE header_str = Qnil;
 
+  TypedData_Get_Struct(wrap, struct curl_slist *, &curl_slist_ptr_type, list);
+
   //rb_p(header);
 
   if (rb_type(header) == T_ARRAY) {
@@ -1862,57 +3725,203 @@ static VALUE cb_each_http_header(VALUE header, VALUE wrap) {
 
     name = rb_obj_as_string(rb_ary_entry(header, 0));
     value = rb_obj_as_string(rb_ary_entry(header, 1));
+    if (rb_str_strlen(value) == 0) { // removing the header e.g. Accept: with nothing trailing should remove it see: https://curl.se/libcurl/c/CURLOPT_HTTPHEADER.html
+      header_str = rb_str_plus(name, rb_str_new2(":"));
+    } else {
+      // This is a bit inefficient, but we don't want to be modifying
+      // the actual values in the original hash.
+      header_str = rb_str_plus(name, rb_str_new2(": "));
+      header_str = rb_str_plus(header_str, value);
+    }
+  } else {
+    header_str = rb_obj_as_string(header);
+  }
+
+  //rb_p(header_str);
+
+  struct curl_slist *new_list = curl_slist_append(*list, StringValuePtr(header_str));
+  if (!new_list) {
+    rb_raise(rb_eNoMemError, "Failed to append to header list");
+  }
+  *list = new_list;
+  return header_str;
+}
+
+/***********************************************
+ * This is an rb_iterate callback used to set up http proxy headers.
+ */
+static VALUE cb_each_http_proxy_header(VALUE proxy_header, VALUE wrap, int _c, const VALUE *_ptr, VALUE unused) {
+  struct curl_slist **list;
+  VALUE proxy_header_str = Qnil;
+
+  TypedData_Get_Struct(wrap, struct curl_slist *, &curl_slist_ptr_type, list);
+
+  //rb_p(proxy_header);
+
+  if (rb_type(proxy_header) == T_ARRAY) {
+    // we're processing a hash, proxy header is [name, val]
+    VALUE name, value;
+
+    name = rb_obj_as_string(rb_ary_entry(proxy_header, 0));
+    value = rb_obj_as_string(rb_ary_entry(proxy_header, 1));
 
     // This is a bit inefficient, but we don't want to be modifying
     // the actual values in the original hash.
-    header_str = rb_str_plus(name, rb_str_new2(": "));
-    header_str = rb_str_plus(header_str, value);
+    proxy_header_str = rb_str_plus(name, rb_str_new2(": "));
+    proxy_header_str = rb_str_plus(proxy_header_str, value);
   } else {
-    header_str = rb_obj_as_string(header);
+    proxy_header_str = rb_obj_as_string(proxy_header);
   }
 
   //rb_p(header_str);
 
-  *list = curl_slist_append(*list, StringValuePtr(header_str));
-  return header_str;
+  struct curl_slist *new_list = curl_slist_append(*list, StringValuePtr(proxy_header_str));
+  if (!new_list) {
+    rb_raise(rb_eNoMemError, "Failed to append to proxy header list");
+  }
+  *list = new_list;
+  return proxy_header_str;
 }
 
 /***********************************************
  * This is an rb_iterate callback used to set up ftp commands.
  */
-static VALUE cb_each_ftp_command(VALUE ftp_command, VALUE wrap) {
+static VALUE cb_each_ftp_command(VALUE ftp_command, VALUE wrap, int _c, const VALUE *_ptr, VALUE unused) {
   struct curl_slist **list;
-  Data_Get_Struct(wrap, struct curl_slist *, list);
+  VALUE ftp_command_string;
+  TypedData_Get_Struct(wrap, struct curl_slist *, &curl_slist_ptr_type, list);
 
-  VALUE ftp_command_string = rb_obj_as_string(ftp_command);
-  *list = curl_slist_append(*list, StringValuePtr(ftp_command));
+  ftp_command_string = rb_obj_as_string(ftp_command);
+  struct curl_slist *new_list = curl_slist_append(*list, StringValuePtr(ftp_command_string));
+  if (!new_list) {
+    rb_raise(rb_eNoMemError, "Failed to append to FTP command list");
+  }
+  *list = new_list;
 
   return ftp_command_string;
 }
 
+/***********************************************
+ * This is an rb_iterate callback used to set up the resolve list.
+ */
+static VALUE cb_each_resolve(VALUE resolve, VALUE wrap, int _c, const VALUE *_ptr, VALUE unused) {
+  struct curl_slist **list;
+  VALUE resolve_string;
+  TypedData_Get_Struct(wrap, struct curl_slist *, &curl_slist_ptr_type, list);
+
+  resolve_string = rb_obj_as_string(resolve);
+  struct curl_slist *new_list = curl_slist_append(*list, StringValuePtr(resolve_string));
+  if (!new_list) {
+    rb_raise(rb_eNoMemError, "Failed to append to resolve list");
+  }
+  *list = new_list;
+
+  return resolve_string;
+}
+
+/***********************************************
+ * This is an rb_iterate callback used to set up the connect-to list.
+ */
+static VALUE cb_each_connect_to(VALUE connect_to, VALUE wrap, int _c, const VALUE *_ptr, VALUE unused) {
+  struct curl_slist **list;
+  VALUE connect_to_string;
+  TypedData_Get_Struct(wrap, struct curl_slist *, &curl_slist_ptr_type, list);
+
+  connect_to_string = rb_obj_as_string(connect_to);
+  struct curl_slist *new_list = curl_slist_append(*list, StringValuePtr(connect_to_string));
+  if (!new_list) {
+    rb_raise(rb_eNoMemError, "Failed to append to connect-to list");
+  }
+  *list = new_list;
+
+  return connect_to_string;
+}
+
 /***********************************************
  *
  * Setup a connection
  *
  * Always returns Qtrue, rb_raise on error.
  */
-VALUE ruby_curl_easy_setup(ruby_curl_easy *rbce) {
+static VALUE ruby_curl_easy_setup_body(VALUE arg) {
+  ruby_curl_easy *rbce = (ruby_curl_easy *)arg;
   // TODO this could do with a bit of refactoring...
   CURL *curl;
   VALUE url, _url = rb_easy_get("url");
   struct curl_slist **hdrs = &(rbce->curl_headers);
+  struct curl_slist **phdrs = &(rbce->curl_proxy_headers);
   struct curl_slist **cmds = &(rbce->curl_ftp_commands);
+  struct curl_slist **rslv = &(rbce->curl_resolve);
+  struct curl_slist **cnto = &(rbce->curl_connect_to);
+  int public_policy_disables_proxy;
 
   curl = rbce->curl;
+  public_policy_disables_proxy = rbce->network_policy == CURB_NETWORK_POLICY_PUBLIC && !rbce->allow_proxy;
+  rbce->callback_error = Qnil;
+  rbce->unsafe_destination_blocked = 0;
+  memset(rbce->unsafe_destination_error, 0, CURL_ERROR_SIZE);
 
   if (_url == Qnil) {
     rb_raise(eCurlErrError, "No URL supplied");
   }
 
   url = rb_check_string_type(_url);
-
   curl_easy_setopt(curl, CURLOPT_URL, StringValuePtr(url));
 
+#ifdef HAVE_CURLOPT_DOH_URL
+  curl_easy_setopt(curl, CURLOPT_DOH_URL, rb_easy_nil("doh_url") ? NULL : rb_easy_get_str("doh_url"));
+#endif
+
+#ifdef HAVE_CURLOPT_DNS_SERVERS
+  if (rbce->network_policy == CURB_NETWORK_POLICY_PUBLIC && !rb_easy_nil("dns_servers")) {
+    rb_raise(eCurlErrUnsafeDestination, "DNS server overrides are disabled by public network policy");
+  }
+  curl_easy_setopt(curl, CURLOPT_DNS_SERVERS, rb_easy_nil("dns_servers") ? NULL : rb_easy_get_str("dns_servers"));
+#endif
+
+#ifdef CURB_HAVE_PREREQ_HOST_POLICY
+  if (!rb_easy_nil("allowed_hosts")) {
+    curb_prepare_network_allowed_hosts(rbce);
+    curl_easy_setopt(curl, CURLOPT_PREREQFUNCTION, curb_host_allowlist_prereq);
+    curl_easy_setopt(curl, CURLOPT_PREREQDATA, rbce);
+  } else {
+    curb_clear_network_allowed_hosts(rbce);
+    curl_easy_setopt(curl, CURLOPT_PREREQFUNCTION, NULL);
+    curl_easy_setopt(curl, CURLOPT_PREREQDATA, NULL);
+  }
+#else
+  curb_clear_network_allowed_hosts(rbce);
+#endif
+
+#ifdef CURB_HAVE_OPENSOCKET_NETWORK_POLICY
+  if (rbce->network_policy == CURB_NETWORK_POLICY_PUBLIC) {
+    curb_prepare_network_allowed_cidr_rules(rbce);
+    curl_easy_setopt(curl, CURLOPT_OPENSOCKETFUNCTION, curb_public_network_opensocket);
+    curl_easy_setopt(curl, CURLOPT_OPENSOCKETDATA, rbce);
+#ifdef HAVE_CURLOPT_FRESH_CONNECT
+    curl_easy_setopt(curl, CURLOPT_FRESH_CONNECT, 1L);
+#endif
+#ifdef HAVE_CURLOPT_FORBID_REUSE
+    curl_easy_setopt(curl, CURLOPT_FORBID_REUSE, 1L);
+#endif
+#ifdef HAVE_CURLOPT_UNIX_SOCKET_PATH
+    if (!rbce->allow_unix_socket) {
+      curl_easy_setopt(curl, CURLOPT_UNIX_SOCKET_PATH, NULL);
+    }
+#endif
+  } else {
+    curb_clear_network_allowed_cidr_rules(rbce);
+    curl_easy_setopt(curl, CURLOPT_OPENSOCKETFUNCTION, NULL);
+    curl_easy_setopt(curl, CURLOPT_OPENSOCKETDATA, NULL);
+#ifdef HAVE_CURLOPT_FRESH_CONNECT
+    curl_easy_setopt(curl, CURLOPT_FRESH_CONNECT, 0L);
+#endif
+#ifdef HAVE_CURLOPT_FORBID_REUSE
+    curl_easy_setopt(curl, CURLOPT_FORBID_REUSE, rbce->forbid_reuse_set ? rbce->forbid_reuse : 0L);
+#endif
+  }
+#endif
+
   // network stuff and auth
   if (!rb_easy_nil("interface_hm")) {
     curl_easy_setopt(curl, CURLOPT_INTERFACE, rb_easy_get_str("interface_hm"));
@@ -1920,7 +3929,7 @@ VALUE ruby_curl_easy_setup(ruby_curl_easy *rbce) {
     curl_easy_setopt(curl, CURLOPT_INTERFACE, NULL);
   }
 
-#if HAVE_CURLOPT_USERNAME == 1 && HAVE_CURLOPT_PASSWORD == 1
+#if defined(HAVE_CURLOPT_USERNAME) && defined(HAVE_CURLOPT_PASSWORD)
   if (!rb_easy_nil("username")) {
     curl_easy_setopt(curl, CURLOPT_USERNAME, rb_easy_get_str("username"));
   } else {
@@ -1936,7 +3945,7 @@ VALUE ruby_curl_easy_setup(ruby_curl_easy *rbce) {
 
   if (!rb_easy_nil("userpwd")) {
     curl_easy_setopt(curl, CURLOPT_USERPWD, rb_easy_get_str("userpwd"));
-#if HAVE_CURLOPT_USERNAME == 1
+#if defined(HAVE_CURLOPT_USERNAME) && defined(HAVE_CURLOPT_PASSWORD)
   } else if (rb_easy_nil("username") && rb_easy_nil("password")) { /* don't set this even to NULL if we have set username and password */
 #else
   } else {
@@ -1944,28 +3953,42 @@ VALUE ruby_curl_easy_setup(ruby_curl_easy *rbce) {
     curl_easy_setopt(curl, CURLOPT_USERPWD, NULL);
   }
 
-  if (rb_easy_nil("proxy_url")) {
+  if (public_policy_disables_proxy) {
+    curl_easy_setopt(curl, CURLOPT_PROXY, "");
+  } else if (rb_easy_nil("proxy_url")) {
     curl_easy_setopt(curl, CURLOPT_PROXY, NULL);
   } else {
     curl_easy_setopt(curl, CURLOPT_PROXY, rb_easy_get_str("proxy_url"));
   }
 
-  if (rb_easy_nil("proxypwd")) {
+  if (public_policy_disables_proxy) {
+    curl_easy_setopt(curl, CURLOPT_PROXYUSERPWD, NULL);
+  } else if (rb_easy_nil("proxypwd")) {
     curl_easy_setopt(curl, CURLOPT_PROXYUSERPWD, NULL);
   } else {
     curl_easy_setopt(curl, CURLOPT_PROXYUSERPWD, rb_easy_get_str("proxypwd"));
   }
 
+#ifdef HAVE_CURLOPT_NOPROXY
+  if (rb_easy_nil("noproxy")) {
+    curl_easy_setopt(curl, CURLOPT_NOPROXY, NULL);
+  } else {
+    curl_easy_setopt(curl, CURLOPT_NOPROXY, rb_easy_get_str("noproxy"));
+  }
+#endif
+
   // body/header procs
+  rbce->downloaded_body_bytes = 0;
+
   if (!rb_easy_nil("body_proc")) {
     curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, (curl_write_callback)&proc_data_handler_body);
     curl_easy_setopt(curl, CURLOPT_WRITEDATA, rbce);
     /* clear out the body_data if it was set */
     rb_easy_del("body_data");
   } else {
-    VALUE body_buffer = rb_easy_set("body_data", rb_str_buf_new(32768));
-    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, (curl_write_callback)&default_data_handler);
-    curl_easy_setopt(curl, CURLOPT_WRITEDATA, body_buffer);
+    rb_easy_set("body_data", rb_str_buf_new(32768));
+    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, (curl_write_callback)&default_body_handler);
+    curl_easy_setopt(curl, CURLOPT_WRITEDATA, rbce);
   }
 
   if (!rb_easy_nil("header_proc")) {
@@ -1974,9 +3997,9 @@ VALUE ruby_curl_easy_setup(ruby_curl_easy *rbce) {
     /* clear out the header_data if it was set */
     rb_easy_del("header_data");
   } else {
-    VALUE header_buffer = rb_easy_set("header_data", rb_str_buf_new(16384));
-    curl_easy_setopt(curl, CURLOPT_HEADERFUNCTION, (curl_write_callback)&default_data_handler);
-    curl_easy_setopt(curl, CURLOPT_HEADERDATA, header_buffer);
+    rb_easy_set("header_data", rb_str_buf_new(16384));
+    curl_easy_setopt(curl, CURLOPT_HEADERFUNCTION, (curl_write_callback)&default_header_handler);
+    curl_easy_setopt(curl, CURLOPT_HEADERDATA, rbce);
   }
 
   /* encoding */
@@ -1986,21 +4009,31 @@ VALUE ruby_curl_easy_setup(ruby_curl_easy *rbce) {
 
   // progress and debug procs
   if (!rb_easy_nil("progress_proc")) {
+#ifdef HAVE_CURLOPT_XFERINFOFUNCTION
+    curl_easy_setopt(curl, CURLOPT_XFERINFOFUNCTION, &proc_xferinfo_handler);
+    curl_easy_setopt(curl, CURLOPT_XFERINFODATA, rbce);
+#else
     curl_easy_setopt(curl, CURLOPT_PROGRESSFUNCTION, (curl_progress_callback)&proc_progress_handler);
-    curl_easy_setopt(curl, CURLOPT_PROGRESSDATA, rb_easy_get("progress_proc"));
+    curl_easy_setopt(curl, CURLOPT_PROGRESSDATA, rbce);
+#endif
     curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 0);
   } else {
     curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 1);
+#ifdef HAVE_CURLOPT_XFERINFOFUNCTION
+    curl_easy_setopt(curl, CURLOPT_XFERINFODATA, rbce);
+#else
+    curl_easy_setopt(curl, CURLOPT_PROGRESSDATA, rbce);
+#endif
   }
 
   if (!rb_easy_nil("debug_proc")) {
     curl_easy_setopt(curl, CURLOPT_DEBUGFUNCTION, (curl_debug_callback)&proc_debug_handler);
-    curl_easy_setopt(curl, CURLOPT_DEBUGDATA, rb_easy_get("debug_proc"));
+    curl_easy_setopt(curl, CURLOPT_DEBUGDATA, rbce);
     curl_easy_setopt(curl, CURLOPT_VERBOSE, 1);
   } else {
     // have to remove handler to re-enable standard verbosity
     curl_easy_setopt(curl, CURLOPT_DEBUGFUNCTION, NULL);
-    curl_easy_setopt(curl, CURLOPT_DEBUGDATA, NULL);
+    curl_easy_setopt(curl, CURLOPT_DEBUGDATA, rbce);
     curl_easy_setopt(curl, CURLOPT_VERBOSE, rbce->verbose);
   }
 
@@ -2008,9 +4041,17 @@ VALUE ruby_curl_easy_setup(ruby_curl_easy *rbce) {
 
   curl_easy_setopt(curl, CURLOPT_HEADER, rbce->header_in_body);
   curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, rbce->follow_location);
+#if LIBCURL_VERSION_NUM == 0x081000
+  /* Work around 8.16.0 regression that clamps -1 (infinite) to zero */
+  if (rbce->max_redirs >= 0) {
+    curl_easy_setopt(curl, CURLOPT_MAXREDIRS, rbce->max_redirs);
+  }
+#else
   curl_easy_setopt(curl, CURLOPT_MAXREDIRS, rbce->max_redirs);
+#endif
 
-  curl_easy_setopt(curl, CURLOPT_HTTPPROXYTUNNEL, rbce->proxy_tunnel);
+  curl_easy_setopt(curl, CURLOPT_HTTPPROXYTUNNEL,
+                   public_policy_disables_proxy ? 0L : rbce->proxy_tunnel);
   curl_easy_setopt(curl, CURLOPT_FILETIME, rbce->fetch_file_time);
   curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, rbce->ssl_verify_peer);
   curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, rbce->ssl_verify_host);
@@ -2023,13 +4064,22 @@ VALUE ruby_curl_easy_setup(ruby_curl_easy *rbce) {
 
   curl_easy_setopt(curl, CURLOPT_UNRESTRICTED_AUTH, rbce->unrestricted_auth);
 
-  curl_easy_setopt(curl, CURLOPT_TIMEOUT, rbce->timeout);
+#ifdef HAVE_CURLOPT_TIMEOUT_MS
+  curl_easy_setopt(curl, CURLOPT_TIMEOUT_MS, rbce->timeout_ms);
+#endif
+
   curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, rbce->connect_timeout);
+#ifdef HAVE_CURLOPT_CONNECTTIMEOUT_MS
+  curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT_MS, rbce->connect_timeout_ms);
+#endif
   curl_easy_setopt(curl, CURLOPT_DNS_CACHE_TIMEOUT, rbce->dns_cache_timeout);
 
   curl_easy_setopt(curl, CURLOPT_IGNORE_CONTENT_LENGTH, rbce->ignore_content_length);
 
   curl_easy_setopt(curl, CURLOPT_IPRESOLVE, rbce->resolve_mode);
+#if HAVE_CURLOPT_HTTP_VERSION
+  curl_easy_setopt(curl, CURLOPT_HTTP_VERSION, rbce->http_version);
+#endif
 
 
 #if LIBCURL_VERSION_NUM >= 0x070a08
@@ -2043,6 +4093,9 @@ VALUE ruby_curl_easy_setup(ruby_curl_easy *rbce) {
   curl_easy_setopt(curl, CURLOPT_LOW_SPEED_LIMIT, rbce->low_speed_limit);
   curl_easy_setopt(curl, CURLOPT_LOW_SPEED_TIME, rbce->low_speed_time);
 
+  curl_easy_setopt(curl, CURLOPT_MAX_RECV_SPEED_LARGE, rbce->max_recv_speed_large);
+  curl_easy_setopt(curl, CURLOPT_MAX_SEND_SPEED_LARGE, rbce->max_send_speed_large);
+
   // Set up localport / proxy port
   // FIXME these won't get returned to default if they're unset Ruby
   if (rbce->proxy_port > 0) {
@@ -2075,29 +4128,27 @@ VALUE ruby_curl_easy_setup(ruby_curl_easy *rbce) {
 #endif
   }
 
-  if (rbce->http_auth_types > 0) {
+  /*
+   * NOTE: we used to set CURLAUTH_ANY but see: http://curl.haxx.se/mail/lib-2015-06/0033.html
+   */
+  if (rbce->http_auth_types != 0) {
 #if LIBCURL_VERSION_NUM >= 0x070a06
     curl_easy_setopt(curl, CURLOPT_HTTPAUTH, rbce->http_auth_types);
-  } else {
-    curl_easy_setopt(curl, CURLOPT_HTTPAUTH, CURLAUTH_ANY);
 #else
     rb_warn("Installed libcurl is too old to support http_auth_types");
 #endif
   }
 
-  if (rbce->proxy_auth_types > 0) {
+  if (rbce->proxy_auth_types != 0) {
 #if LIBCURL_VERSION_NUM >= 0x070a07
     curl_easy_setopt(curl, CURLOPT_PROXYAUTH, rbce->proxy_auth_types);
-  } else {
-    curl_easy_setopt(curl, CURLOPT_PROXYAUTH, CURLAUTH_ANY);
 #else
     rb_warn("Installed libcurl is too old to support proxy_auth_types");
 #endif
   }
 
-  /* Set up HTTP cookie handling if necessary
-     FIXME this may not get disabled if it's enabled, the disabled again from ruby.
-     */
+  /* Set up HTTP cookie handling if necessary */
+  /* Enable/attach cookie engine if requested, or implicitly via COOKIELIST usage */
   if (rbce->enable_cookies) {
     if (!rb_easy_nil("cookiejar")) {
       curl_easy_setopt(curl, CURLOPT_COOKIEJAR, rb_easy_get_str("cookiejar"));
@@ -2108,6 +4159,9 @@ VALUE ruby_curl_easy_setup(ruby_curl_easy *rbce) {
     } else {
       curl_easy_setopt(curl, CURLOPT_COOKIEFILE, ""); /* "" = magic to just enable */
     }
+  } else if (rbce->cookielist_engine_enabled) {
+    /* Ensure cookie engine is enabled even if enable_cookies? is false. */
+    curl_easy_setopt(curl, CURLOPT_COOKIEFILE, "");
   }
 
   if (!rb_easy_nil("cookies")) {
@@ -2150,7 +4204,7 @@ VALUE ruby_curl_easy_setup(ruby_curl_easy *rbce) {
     rb_warn("libcurl is not configured with SSL support");
   }
 #endif
-  
+
   if (rbce->ftp_filemethod > 0) {
     curl_easy_setopt(curl, CURLOPT_FTP_FILEMETHOD, rbce->ftp_filemethod);
   }
@@ -2160,16 +4214,25 @@ VALUE ruby_curl_easy_setup(ruby_curl_easy *rbce) {
     curl_easy_setopt(curl, CURLOPT_USERAGENT, rb_easy_get_str("useragent"));
   }
 
+  /* Setup can be rerun for safety-policy changes while a handle is attached.
+   * Rebuild slist-backed options from Ruby opts instead of appending to stale
+   * native lists. */
+  ruby_curl_easy_clear_setup_lists(rbce);
+
   /* Setup HTTP headers if necessary */
   curl_easy_setopt(curl, CURLOPT_HTTPHEADER, NULL);   // XXX: maybe we shouldn't be clearing this?
 
   if (!rb_easy_nil("headers")) {
     if (rb_easy_type_check("headers", T_ARRAY) || rb_easy_type_check("headers", T_HASH)) {
-      VALUE wrap = Data_Wrap_Struct(rb_cObject, 0, 0, hdrs);
-      rb_iterate(rb_each, rb_easy_get("headers"), cb_each_http_header, wrap);
+      VALUE wrap = TypedData_Wrap_Struct(rb_cObject, &curl_slist_ptr_type, hdrs);
+      rb_block_call(rb_easy_get("headers"), rb_intern("each"), 0, NULL, cb_each_http_header, wrap);
     } else {
       VALUE headers_str = rb_obj_as_string(rb_easy_get("headers"));
-      *hdrs = curl_slist_append(*hdrs, StringValuePtr(headers_str));
+      struct curl_slist *new_list = curl_slist_append(*hdrs, StringValuePtr(headers_str));
+      if (!new_list) {
+        rb_raise(rb_eNoMemError, "Failed to append to headers list");
+      }
+      *hdrs = new_list;
     }
 
     if (*hdrs) {
@@ -2177,11 +4240,34 @@ VALUE ruby_curl_easy_setup(ruby_curl_easy *rbce) {
     }
   }
 
+#ifdef HAVE_CURLOPT_PROXYHEADER
+  /* Setup HTTP proxy headers if necessary */
+  curl_easy_setopt(curl, CURLOPT_PROXYHEADER, NULL);   // XXX: maybe we shouldn't be clearing this?
+
+  if (!rb_easy_nil("proxy_headers")) {
+    if (rb_easy_type_check("proxy_headers", T_ARRAY) || rb_easy_type_check("proxy_headers", T_HASH)) {
+      VALUE wrap = TypedData_Wrap_Struct(rb_cObject, &curl_slist_ptr_type, phdrs);
+      rb_block_call(rb_easy_get("proxy_headers"), rb_intern("each"), 0, NULL, cb_each_http_proxy_header, wrap);
+    } else {
+      VALUE proxy_headers_str = rb_obj_as_string(rb_easy_get("proxy_headers"));
+      struct curl_slist *new_list = curl_slist_append(*phdrs, StringValuePtr(proxy_headers_str));
+      if (!new_list) {
+        rb_raise(rb_eNoMemError, "Failed to append to proxy headers list");
+      }
+      *phdrs = new_list;
+    }
+
+    if (*phdrs) {
+      curl_easy_setopt(curl, CURLOPT_PROXYHEADER, *phdrs);
+    }
+  }
+#endif
+
   /* Setup FTP commands if necessary */
   if (!rb_easy_nil("ftp_commands")) {
     if (rb_easy_type_check("ftp_commands", T_ARRAY)) {
-      VALUE wrap = Data_Wrap_Struct(rb_cObject, 0, 0, cmds);
-      rb_iterate(rb_each, rb_easy_get("ftp_commands"), cb_each_ftp_command, wrap);
+      VALUE wrap = TypedData_Wrap_Struct(rb_cObject, &curl_slist_ptr_type, cmds);
+      rb_block_call(rb_easy_get("ftp_commands"), rb_intern("each"), 0, NULL, cb_each_ftp_command, wrap);
     }
 
     if (*cmds) {
@@ -2189,40 +4275,155 @@ VALUE ruby_curl_easy_setup(ruby_curl_easy *rbce) {
     }
   }
 
+#ifdef HAVE_CURLOPT_RESOLVE
+  /* Setup resolve list if necessary */
+  if (!rb_easy_nil("resolve")) {
+    if (rb_easy_type_check("resolve", T_ARRAY)) {
+      VALUE wrap = TypedData_Wrap_Struct(rb_cObject, &curl_slist_ptr_type, rslv);
+      rb_block_call(rb_easy_get("resolve"), rb_intern("each"), 0, NULL, cb_each_resolve, wrap);
+    } else {
+      VALUE resolve_str = rb_obj_as_string(rb_easy_get("resolve"));
+      struct curl_slist *new_list = curl_slist_append(*rslv, StringValuePtr(resolve_str));
+      if (!new_list) {
+        rb_raise(rb_eNoMemError, "Failed to append to resolve list");
+      }
+      *rslv = new_list;
+    }
+
+    if (*rslv) {
+      curl_easy_setopt(curl, CURLOPT_RESOLVE, *rslv);
+    }
+  }
+#endif
+
+#ifdef HAVE_CURLOPT_CONNECT_TO
+  /* Setup connect-to list if necessary */
+  if (!rb_easy_nil("connect_to")) {
+    if (rb_easy_type_check("connect_to", T_ARRAY)) {
+      VALUE wrap = TypedData_Wrap_Struct(rb_cObject, &curl_slist_ptr_type, cnto);
+      rb_block_call(rb_easy_get("connect_to"), rb_intern("each"), 0, NULL, cb_each_connect_to, wrap);
+    } else {
+      VALUE connect_to_str = rb_obj_as_string(rb_easy_get("connect_to"));
+      struct curl_slist *new_list = curl_slist_append(*cnto, StringValuePtr(connect_to_str));
+      if (!new_list) {
+        rb_raise(rb_eNoMemError, "Failed to append to connect-to list");
+      }
+      *cnto = new_list;
+    }
+
+    if (*cnto) {
+      curl_easy_setopt(curl, CURLOPT_CONNECT_TO, *cnto);
+    }
+  }
+#endif
+
   return Qnil;
 }
+
+VALUE ruby_curl_easy_setup(ruby_curl_easy *rbce) {
+  ruby_curl_easy_enter_native(rbce);
+  return rb_ensure(ruby_curl_easy_setup_body, (VALUE)rbce,
+                   ruby_curl_easy_leave_native, (VALUE)rbce);
+}
+
+static VALUE ruby_curl_easy_setup_self(VALUE self) {
+  ruby_curl_easy *rbce;
+
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
+  ruby_curl_easy_setup(rbce);
+
+  return self;
+}
 /***********************************************
  *
  * Clean up a connection
  *
- * Always returns Qtrue.
+ * Always returns Qnil.
  */
 VALUE ruby_curl_easy_cleanup( VALUE self, ruby_curl_easy *rbce ) {
 
   CURL *curl = rbce->curl;
   struct curl_slist *ftp_commands;
+  struct curl_slist *resolve;
+  struct curl_slist *connect_to;
 
-  /* Free everything up */
-  if (rbce->curl_headers) {
-    curl_slist_free_all(rbce->curl_headers);
-    rbce->curl_headers = NULL;
-  }
+  ruby_curl_easy_clear_headers_list(rbce);
+  ruby_curl_easy_clear_proxy_headers_list(rbce);
 
   ftp_commands = rbce->curl_ftp_commands;
   if (ftp_commands) {
-    curl_slist_free_all(ftp_commands);
-    rbce->curl_ftp_commands = NULL;
+    ruby_curl_easy_clear_ftp_commands_list(rbce);
   }
 
+  resolve = rbce->curl_resolve;
+  if (resolve) {
+    ruby_curl_easy_clear_resolve_list(rbce);
+  }
+
+  connect_to = rbce->curl_connect_to;
+  if (connect_to) {
+    ruby_curl_easy_clear_connect_to_list(rbce);
+  }
+
+  curb_clear_network_allowed_cidr_rules(rbce);
+  curb_clear_network_allowed_hosts(rbce);
+
   /* clean up a PUT request's curl options. */
   if (!rb_easy_nil("upload")) {
     rb_easy_del("upload"); // set the upload object to Qnil to let the GC clean up
     curl_easy_setopt(curl, CURLOPT_UPLOAD, 0);
     curl_easy_setopt(curl, CURLOPT_READFUNCTION, NULL);
     curl_easy_setopt(curl, CURLOPT_READDATA, NULL);
+#ifdef HAVE_CURLOPT_SEEKFUNCTION
+    curl_easy_setopt(curl, CURLOPT_SEEKFUNCTION, NULL);
+#endif
+#ifdef HAVE_CURLOPT_SEEKDATA
+    curl_easy_setopt(curl, CURLOPT_SEEKDATA, NULL);
+#endif
     curl_easy_setopt(curl, CURLOPT_INFILESIZE, 0);
   }
 
+  // set values on cleanup to nil
+  //rb_easy_del("multi");
+
+  return Qnil;
+}
+
+struct easy_perform_request_restore_args {
+  VALUE self;
+  CURL *curl;
+  ruby_curl_easy *rbce;
+  int clear_customrequest;
+  int clear_nobody;
+  int clear_postfields;
+};
+
+static VALUE perform_with_request_restore_body(VALUE argp) {
+  struct easy_perform_request_restore_args *args = (struct easy_perform_request_restore_args *)argp;
+  return rb_funcall(args->self, rb_intern("perform"), 0);
+}
+
+static VALUE perform_with_request_restore_ensure(VALUE argp) {
+  struct easy_perform_request_restore_args *args = (struct easy_perform_request_restore_args *)argp;
+
+  if (args->curl) {
+    if (args->clear_nobody) {
+      curl_easy_setopt(args->curl, CURLOPT_NOBODY, 0L);
+    }
+    if (args->clear_customrequest) {
+      curl_easy_setopt(args->curl, CURLOPT_CUSTOMREQUEST, NULL);
+    }
+    if (args->clear_postfields) {
+      curl_easy_setopt(args->curl, CURLOPT_POST, 0L);
+      curl_easy_setopt(args->curl, CURLOPT_POSTFIELDS, NULL);
+      curl_easy_setopt(args->curl, CURLOPT_POSTFIELDSIZE, 0L);
+      curl_easy_setopt(args->curl, CURLOPT_HTTPGET, 1L);
+      if (args->rbce && !NIL_P(args->rbce->opts)) {
+        rb_hash_delete(args->rbce->opts, rb_easy_hkey("postdata_buffer"));
+      }
+    }
+  }
+
   return Qnil;
 }
 
@@ -2234,14 +4435,33 @@ static VALUE ruby_curl_easy_perform_verb_str(VALUE self, const char *verb) {
   CURL *curl;
   VALUE retval;
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
   curl = rbce->curl;
 
+  memset(rbce->err_buf, 0, CURL_ERROR_SIZE);
+
+  /* Use method override and adjust related options for special verbs. */
   curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, verb);
 
-  retval = rb_funcall(self, rb_intern("perform"), 0);
+  /* For HEAD, ensure no body is requested/downloaded, as some servers
+   * include a Content-Length header which should not cause libcurl to
+   * wait for a body that will never arrive. */
+  int is_head = (verb && (
+#ifdef _WIN32
+    _stricmp(verb, "HEAD") == 0
+#else
+    strcasecmp(verb, "HEAD") == 0
+#endif
+  ));
+  if (is_head) {
+    curl_easy_setopt(curl, CURLOPT_NOBODY, 1L);
+    curl_easy_setopt(curl, CURLOPT_HTTPGET, 0L);
+    curl_easy_setopt(curl, CURLOPT_POST, 0L);
+  }
 
-  curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, NULL);
+  struct easy_perform_request_restore_args restore_args = { self, curl, rbce, 1, is_head, 0 };
+  retval = rb_ensure(perform_with_request_restore_body, (VALUE)&restore_args,
+                     perform_with_request_restore_ensure, (VALUE)&restore_args);
 
   return retval;
 }
@@ -2262,9 +4482,96 @@ static VALUE ruby_curl_easy_perform_verb(VALUE self, VALUE verb) {
     str_verb = rb_funcall(verb, rb_intern("to_s"), 0);
     return ruby_curl_easy_perform_verb_str(self, StringValueCStr(str_verb));
   }
-  else {
-    rb_raise(rb_eRuntimeError, "Invalid HTTP VERB, must response to 'to_s'");
+  else {
+    rb_raise(rb_eRuntimeError, "Invalid HTTP VERB, must response to 'to_s'");
+  }
+}
+
+static VALUE call_easy_perform(VALUE self) {
+  return rb_funcall(self, rb_intern("perform"), 0);
+}
+
+struct easy_form_perform_args {
+  VALUE self;
+  CURL *curl;
+  int argc;
+  VALUE *argv;
+  struct curl_httppost *first;
+  struct curl_httppost *last;
+  int clear_customrequest;
+  int form_set_on_curl;
+};
+
+struct easy_join_args {
+  VALUE args_ary;
+};
+
+static VALUE join_easy_arguments_body(VALUE argp) {
+  struct easy_join_args *args = (struct easy_join_args *)argp;
+  return rb_funcall(args->args_ary, idJoin, 1, rbstrAmp);
+}
+
+static VALUE join_easy_arguments(ruby_curl_easy *rbce, VALUE args_ary) {
+  struct easy_join_args args = { args_ary };
+
+  ruby_curl_easy_enter_native(rbce);
+  return rb_ensure(join_easy_arguments_body, (VALUE)&args,
+                   ruby_curl_easy_leave_native, (VALUE)rbce);
+}
+
+static void append_multipart_form_argument(VALUE arg,
+                                           struct curl_httppost **first,
+                                           struct curl_httppost **last) {
+  if (rb_obj_is_instance_of(arg, cCurlPostField)) {
+    append_to_form(arg, first, last);
+  } else if (rb_type(arg) == T_ARRAY) {
+    long j, argv_len = RARRAY_LEN(arg);
+    for (j = 0; j < argv_len; ++j) {
+      VALUE field = rb_ary_entry(arg, j);
+      if (rb_obj_is_instance_of(field, cCurlPostField)) {
+        append_to_form(field, first, last);
+      } else {
+        rb_raise(eCurlErrInvalidPostField,
+                 "You must use PostFields only with multipart form posts");
+      }
+    }
+  } else {
+    rb_raise(eCurlErrInvalidPostField,
+             "You must use PostFields only with multipart form posts");
+  }
+}
+
+static VALUE build_and_perform_multipart_form(VALUE argp) {
+  struct easy_form_perform_args *args = (struct easy_form_perform_args *)argp;
+  int i;
+
+  for (i = 0; i < args->argc; i++) {
+    append_multipart_form_argument(args->argv[i], &args->first, &args->last);
+  }
+
+  curl_easy_setopt(args->curl, CURLOPT_POST, 0);
+  curl_easy_setopt(args->curl, CURLOPT_HTTPPOST, args->first);
+  args->form_set_on_curl = 1;
+
+  return call_easy_perform(args->self);
+}
+
+static VALUE ensure_free_form_post(VALUE argp) {
+  struct easy_form_perform_args *args = (struct easy_form_perform_args *)argp;
+  if (args->curl) {
+    if (args->form_set_on_curl) {
+      curl_easy_setopt(args->curl, CURLOPT_HTTPPOST, NULL);
+    }
+    if (args->clear_customrequest) {
+      curl_easy_setopt(args->curl, CURLOPT_CUSTOMREQUEST, NULL);
+    }
+  }
+  if (args->first) {
+    curl_formfree(args->first);
+    args->first = NULL;
   }
+  args->last = NULL;
+  return Qnil;
 }
 
 /*
@@ -2294,51 +4601,27 @@ static VALUE ruby_curl_easy_perform_verb(VALUE self, VALUE verb) {
 static VALUE ruby_curl_easy_perform_post(int argc, VALUE *argv, VALUE self) {
   ruby_curl_easy *rbce;
   CURL *curl;
-  int i;
   VALUE args_ary;
 
   rb_scan_args(argc, argv, "*", &args_ary);
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
   curl = rbce->curl;
 
+  memset(rbce->err_buf, 0, CURL_ERROR_SIZE);
+
   curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, NULL);
 
   if (rbce->multipart_form_post) {
     VALUE ret;
-    struct curl_httppost *first = NULL, *last = NULL;
-
-    // Make the multipart form
-    for (i = 0; i < argc; i++) {
-      if (rb_obj_is_instance_of(argv[i], cCurlPostField)) {
-        append_to_form(argv[i], &first, &last);
-      } else if (rb_type(argv[i]) == T_ARRAY) {
-        // see: https://github.com/rvanlieshout/curb/commit/8bcdefddc0162484681ebd1a92d52a642666a445
-        int c = 0, argv_len = (int)RARRAY_LEN(argv[i]);
-        for (; c < argv_len; ++c) {
-          if (rb_obj_is_instance_of(rb_ary_entry(argv[i],c), cCurlPostField)) {
-            append_to_form(rb_ary_entry(argv[i],c), &first, &last);
-          } else {
-            rb_raise(eCurlErrInvalidPostField, "You must use PostFields only with multipart form posts");
-            return Qnil;
-          }
-        }
-      } else {
-        rb_raise(eCurlErrInvalidPostField, "You must use PostFields only with multipart form posts");
-        return Qnil;
-      }
-    }
-
-    curl_easy_setopt(curl, CURLOPT_POST, 0);
-    curl_easy_setopt(curl, CURLOPT_HTTPPOST, first);
-    ret = rb_funcall(self, rb_intern("perform"), 0);
-    curl_formfree(first);
+    struct easy_form_perform_args perform_args = { self, curl, argc, argv, NULL, NULL, 0, 0 };
+    ret = rb_ensure(build_and_perform_multipart_form, (VALUE)&perform_args, ensure_free_form_post, (VALUE)&perform_args);
 
     return ret;
   } else {
     VALUE post_body = Qnil;
     /* TODO: check for PostField.file and raise error before to_s fails */
-    if ((post_body = rb_funcall(args_ary, idJoin, 1, rbstrAmp)) == Qnil) {
+    if ((post_body = join_easy_arguments(rbce, args_ary)) == Qnil) {
       rb_raise(eCurlErrError, "Failed to join arguments");
       return Qnil;
     } else {
@@ -2353,7 +4636,65 @@ static VALUE ruby_curl_easy_perform_post(int argc, VALUE *argv, VALUE self) {
         ruby_curl_easy_post_body_set(self, post_body);
       }
 
-      return rb_funcall(self, rb_intern("perform"), 0);
+      struct easy_perform_request_restore_args restore_args = { self, curl, rbce, 1, 0, 0 };
+      return rb_ensure(perform_with_request_restore_body, (VALUE)&restore_args,
+                       perform_with_request_restore_ensure, (VALUE)&restore_args);
+    }
+  }
+}
+
+/*
+ * call-seq:
+ *   easy.http_patch("url=encoded%20form%20data;and=so%20on") => true
+ *   easy.http_patch("url=encoded%20form%20data", "and=so%20on", ...) => true
+ *   easy.http_patch("url=encoded%20form%20data", Curl::PostField, "and=so%20on", ...) => true
+ *   easy.http_patch(Curl::PostField, Curl::PostField ..., Curl::PostField) => true
+ *
+ * PATCH the specified formdata to the currently configured URL using
+ * the current options set for this Curl::Easy instance. This method
+ * always returns true, or raises an exception (defined under
+ * Curl::Err) on error.
+ *
+ * When multipart_form_post is true the multipart logic is used; otherwise,
+ * the arguments are joined into a raw PATCH body.
+ */
+static VALUE ruby_curl_easy_perform_patch(int argc, VALUE *argv, VALUE self) {
+  ruby_curl_easy *rbce;
+  CURL *curl;
+  VALUE args_ary;
+
+  rb_scan_args(argc, argv, "*", &args_ary);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
+  curl = rbce->curl;
+
+  /* Clear the error buffer */
+  memset(rbce->err_buf, 0, CURL_ERROR_SIZE);
+
+  /* Set the custom HTTP method to PATCH */
+  curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "PATCH");
+
+  if (rbce->multipart_form_post) {
+    VALUE ret;
+    struct easy_form_perform_args perform_args = { self, curl, argc, argv, NULL, NULL, 1, 0 };
+    ret = rb_ensure(build_and_perform_multipart_form, (VALUE)&perform_args, ensure_free_form_post, (VALUE)&perform_args);
+    return ret;
+  } else {
+    /* Join arguments into a raw PATCH body */
+    VALUE patch_body = join_easy_arguments(rbce, args_ary);
+    if (patch_body == Qnil) {
+      rb_raise(eCurlErrError, "Failed to join arguments");
+      return Qnil;
+    } else {
+      if (rb_type(patch_body) == T_STRING && RSTRING_LEN(patch_body) > 0) {
+        ruby_curl_easy_post_body_set(self, patch_body);
+      }
+      /* If postdata_buffer is still nil, set it so that the PATCH header is enabled */
+      if (rb_easy_nil("postdata_buffer")) {
+        ruby_curl_easy_post_body_set(self, patch_body);
+      }
+      struct easy_perform_request_restore_args restore_args = { self, curl, rbce, 1, 0, 1 };
+      return rb_ensure(perform_with_request_restore_body, (VALUE)&restore_args,
+                       perform_with_request_restore_ensure, (VALUE)&restore_args);
     }
   }
 }
@@ -2366,17 +4707,47 @@ static VALUE ruby_curl_easy_perform_post(int argc, VALUE *argv, VALUE self) {
  * current options set for this Curl::Easy instance. This method always
  * returns true, or raises an exception (defined under Curl::Err) on error.
  */
-static VALUE ruby_curl_easy_perform_put(VALUE self, VALUE data) {
+static VALUE ruby_curl_easy_perform_put(int argc, VALUE *argv, VALUE self) {
   ruby_curl_easy *rbce;
   CURL *curl;
+  VALUE args_ary;
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+  rb_scan_args(argc, argv, "*", &args_ary);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
   curl = rbce->curl;
 
-  curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, NULL);
-  ruby_curl_easy_put_data_set(self, data);
+  memset(rbce->err_buf, 0, CURL_ERROR_SIZE);
+  curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "PUT");
 
-  return rb_funcall(self, rb_intern("perform"), 0);
+  /* New: if no arguments were provided, treat as an empty PUT */
+  if (RARRAY_LEN(args_ary) == 0) {
+    /* Option 1: explicitly set an empty body */
+    ruby_curl_easy_put_data_set(self, rb_str_new2(""));
+  }
+  /* If a single argument is given and it is a String or responds to read, use legacy behavior */
+  else if (RARRAY_LEN(args_ary) == 1 &&
+           (rb_type(rb_ary_entry(args_ary, 0)) == T_STRING ||
+            rb_respond_to(rb_ary_entry(args_ary, 0), rb_intern("read")))) {
+    ruby_curl_easy_put_data_set(self, rb_ary_entry(args_ary, 0));
+  }
+  /* Otherwise, if multipart_form_post is true, use multipart logic */
+  else if (rbce->multipart_form_post) {
+    VALUE ret;
+    struct easy_form_perform_args perform_args = { self, curl, argc, argv, NULL, NULL, 1, 0 };
+    ret = rb_ensure(build_and_perform_multipart_form, (VALUE)&perform_args, ensure_free_form_post, (VALUE)&perform_args);
+    return ret;
+  }
+  /* Fallback: join all arguments */
+  else {
+    VALUE post_body = join_easy_arguments(rbce, args_ary);
+    if (post_body != Qnil && rb_type(post_body) == T_STRING &&
+        RSTRING_LEN(post_body) > 0) {
+      ruby_curl_easy_put_data_set(self, post_body);
+    }
+  }
+  struct easy_perform_request_restore_args restore_args = { self, curl, rbce, 1, 0, 0 };
+  return rb_ensure(perform_with_request_restore_body, (VALUE)&restore_args,
+                   perform_with_request_restore_ensure, (VALUE)&restore_args);
 }
 
 
@@ -2391,9 +4762,54 @@ static VALUE ruby_curl_easy_perform_put(VALUE self, VALUE data) {
  * your own body handler, this string will be empty.
  */
 static VALUE ruby_curl_easy_body_str_get(VALUE self) {
+  /*
+     TODO: can we force_encoding on the return here if we see charset=utf-8 in the content-type header?
+     Content-Type: application/json; charset=utf-8
+  */
   CURB_OBJECT_HGETTER(ruby_curl_easy, body_data);
 }
 
+/*
+ * call-seq:
+ *   easy.max_body_bytes = bytes_or_nil                  => bytes_or_nil
+ *
+ * Set an application-level cap for bytes accepted by the body write callback.
+ * +nil+ or 0 clears the cap.
+ */
+static VALUE ruby_curl_easy_max_body_bytes_set(VALUE self, VALUE val) {
+  ruby_curl_easy *rbce;
+  long long limit;
+
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
+
+  if (NIL_P(val)) {
+    rb_hash_delete(rbce->opts, rb_easy_hkey("max_body_bytes"));
+    return Qnil;
+  }
+
+  limit = NUM2LL(val);
+  if (limit < 0) {
+    rb_raise(rb_eArgError, "max_body_bytes must be greater than or equal to zero");
+  }
+
+  if (limit == 0) {
+    rb_hash_delete(rbce->opts, rb_easy_hkey("max_body_bytes"));
+  } else {
+    val = LL2NUM(limit);
+    rb_hash_aset(rbce->opts, rb_easy_hkey("max_body_bytes"), val);
+  }
+
+  return val;
+}
+
+/*
+ * call-seq:
+ *   easy.max_body_bytes                                => bytes_or_nil
+ */
+static VALUE ruby_curl_easy_max_body_bytes_get(VALUE self) {
+  CURB_OBJECT_HGETTER(ruby_curl_easy, max_body_bytes);
+}
+
 /*
  * call-seq:
  *   easy.header_str                                  => "response header"
@@ -2421,7 +4837,7 @@ static VALUE ruby_curl_easy_last_effective_url_get(VALUE self) {
   ruby_curl_easy *rbce;
   char* url;
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
   curl_easy_getinfo(rbce->curl, CURLINFO_EFFECTIVE_URL, &url);
 
   if (url && url[0]) {    // curl returns empty string if none
@@ -2444,7 +4860,7 @@ static VALUE ruby_curl_easy_response_code_get(VALUE self) {
   ruby_curl_easy *rbce;
   long code;
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
 #ifdef HAVE_CURLINFO_RESPONSE_CODE
   curl_easy_getinfo(rbce->curl, CURLINFO_RESPONSE_CODE, &code);
 #else
@@ -2467,8 +4883,8 @@ static VALUE ruby_curl_easy_response_code_get(VALUE self) {
 static VALUE ruby_curl_easy_primary_ip_get(VALUE self) {
   ruby_curl_easy *rbce;
   char* ip;
-  
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
   curl_easy_getinfo(rbce->curl, CURLINFO_PRIMARY_IP, &ip);
 
   if (ip && ip[0]) {    // curl returns empty string if none
@@ -2489,7 +4905,7 @@ static VALUE ruby_curl_easy_http_connect_code_get(VALUE self) {
   ruby_curl_easy *rbce;
   long code;
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
   curl_easy_getinfo(rbce->curl, CURLINFO_HTTP_CONNECTCODE, &code);
 
   return LONG2NUM(code);
@@ -2517,13 +4933,13 @@ static VALUE ruby_curl_easy_file_time_get(VALUE self) {
   ruby_curl_easy *rbce;
   long time;
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
   curl_easy_getinfo(rbce->curl, CURLINFO_FILETIME, &time);
 
   return LONG2NUM(time);
 #else
   rb_warn("Installed libcurl is too old to support file_time");
-  return INT2FIX(0);
+  return LONG2NUM(0);
 #endif
 }
 
@@ -2538,7 +4954,7 @@ static VALUE ruby_curl_easy_total_time_get(VALUE self) {
   ruby_curl_easy *rbce;
   double time;
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
   curl_easy_getinfo(rbce->curl, CURLINFO_TOTAL_TIME, &time);
 
   return rb_float_new(time);
@@ -2555,7 +4971,7 @@ static VALUE ruby_curl_easy_name_lookup_time_get(VALUE self) {
   ruby_curl_easy *rbce;
   double time;
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
   curl_easy_getinfo(rbce->curl, CURLINFO_NAMELOOKUP_TIME, &time);
 
   return rb_float_new(time);
@@ -2572,7 +4988,7 @@ static VALUE ruby_curl_easy_connect_time_get(VALUE self) {
   ruby_curl_easy *rbce;
   double time;
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
   curl_easy_getinfo(rbce->curl, CURLINFO_CONNECT_TIME, &time);
 
   return rb_float_new(time);
@@ -2585,7 +5001,7 @@ static VALUE ruby_curl_easy_connect_time_get(VALUE self) {
  * Retrieve the time, in seconds, it took from the start until the SSL/SSH
  * connect/handshake to the remote host was completed. This time is most often
  * very near to the pre transfer time, except for cases such as HTTP
- * pippelining where the pretransfer time can be delayed due to waits in line
+ * pipelining where the pretransfer time can be delayed due to waits in line
  * for the pipeline and more.
  */
 #if defined(HAVE_CURLINFO_APPCONNECT_TIME)
@@ -2593,7 +5009,7 @@ static VALUE ruby_curl_easy_app_connect_time_get(VALUE self) {
   ruby_curl_easy *rbce;
   double time;
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
   curl_easy_getinfo(rbce->curl, CURLINFO_APPCONNECT_TIME, &time);
 
   return rb_float_new(time);
@@ -2614,7 +5030,7 @@ static VALUE ruby_curl_easy_pre_transfer_time_get(VALUE self) {
   ruby_curl_easy *rbce;
   double time;
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
   curl_easy_getinfo(rbce->curl, CURLINFO_PRETRANSFER_TIME, &time);
 
   return rb_float_new(time);
@@ -2632,7 +5048,7 @@ static VALUE ruby_curl_easy_start_transfer_time_get(VALUE self) {
   ruby_curl_easy *rbce;
   double time;
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
   curl_easy_getinfo(rbce->curl, CURLINFO_STARTTRANSFER_TIME, &time);
 
   return rb_float_new(time);
@@ -2654,7 +5070,7 @@ static VALUE ruby_curl_easy_redirect_time_get(VALUE self) {
   ruby_curl_easy *rbce;
   double time;
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
   curl_easy_getinfo(rbce->curl, CURLINFO_REDIRECT_TIME, &time);
 
   return rb_float_new(time);
@@ -2677,13 +5093,13 @@ static VALUE ruby_curl_easy_redirect_count_get(VALUE self) {
   ruby_curl_easy *rbce;
   long count;
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
   curl_easy_getinfo(rbce->curl, CURLINFO_REDIRECT_COUNT, &count);
 
   return LONG2NUM(count);
 #else
   rb_warn("Installed libcurl is too old to support redirect_count");
-  return INT2FIX(-1);
+  return LONG2NUM(-1);
 #endif
 
 }
@@ -2692,7 +5108,7 @@ static VALUE ruby_curl_easy_redirect_count_get(VALUE self) {
  * call-seq:
  *   easy.redirect_url                               => "http://some.url" or nil
  *
- * Retrieve  the URL a redirect would take you to if you 
+ * Retrieve  the URL a redirect would take you to if you
  * would enable CURLOPT_FOLLOWLOCATION.
  *
  * Requires libcurl 7.18.2 or higher, otherwise -1 is always returned.
@@ -2702,7 +5118,7 @@ static VALUE ruby_curl_easy_redirect_url_get(VALUE self) {
   ruby_curl_easy *rbce;
   char* url;
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
   curl_easy_getinfo(rbce->curl, CURLINFO_REDIRECT_URL, &url);
 
   if (url && url[0]) {    // curl returns empty string if none
@@ -2712,7 +5128,7 @@ static VALUE ruby_curl_easy_redirect_url_get(VALUE self) {
   }
 #else
   rb_warn("Installed libcurl is too old to support redirect_url");
-  return INT2FIX(-1);
+  return LONG2NUM(-1);
 #endif
 }
 
@@ -2727,12 +5143,17 @@ static VALUE ruby_curl_easy_redirect_url_get(VALUE self) {
  */
 static VALUE ruby_curl_easy_uploaded_bytes_get(VALUE self) {
   ruby_curl_easy *rbce;
-  double bytes;
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+#ifdef HAVE_CURLINFO_SIZE_UPLOAD_T
+  curl_off_t bytes;
+  curl_easy_getinfo(rbce->curl, CURLINFO_SIZE_UPLOAD_T, &bytes);
+  return LL2NUM(bytes);
+#else
+  double bytes;
   curl_easy_getinfo(rbce->curl, CURLINFO_SIZE_UPLOAD, &bytes);
-
   return rb_float_new(bytes);
+#endif
 }
 
 /*
@@ -2744,12 +5165,17 @@ static VALUE ruby_curl_easy_uploaded_bytes_get(VALUE self) {
  */
 static VALUE ruby_curl_easy_downloaded_bytes_get(VALUE self) {
   ruby_curl_easy *rbce;
-  double bytes;
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+#ifdef HAVE_CURLINFO_SIZE_DOWNLOAD_T
+  curl_off_t bytes;
+  curl_easy_getinfo(rbce->curl, CURLINFO_SIZE_DOWNLOAD_T, &bytes);
+  return LL2NUM(bytes);
+#else
+  double bytes;
   curl_easy_getinfo(rbce->curl, CURLINFO_SIZE_DOWNLOAD, &bytes);
-
   return rb_float_new(bytes);
+#endif
 }
 
 /*
@@ -2761,12 +5187,17 @@ static VALUE ruby_curl_easy_downloaded_bytes_get(VALUE self) {
  */
 static VALUE ruby_curl_easy_upload_speed_get(VALUE self) {
   ruby_curl_easy *rbce;
-  double bytes;
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+#ifdef HAVE_CURLINFO_SPEED_UPLOAD_T
+  curl_off_t bytes;
+  curl_easy_getinfo(rbce->curl, CURLINFO_SPEED_UPLOAD_T, &bytes);
+  return LL2NUM(bytes);
+#else
+  double bytes;
   curl_easy_getinfo(rbce->curl, CURLINFO_SPEED_UPLOAD, &bytes);
-
   return rb_float_new(bytes);
+#endif
 }
 
 /*
@@ -2778,12 +5209,17 @@ static VALUE ruby_curl_easy_upload_speed_get(VALUE self) {
  */
 static VALUE ruby_curl_easy_download_speed_get(VALUE self) {
   ruby_curl_easy *rbce;
-  double bytes;
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+#ifdef HAVE_CURLINFO_SPEED_DOWNLOAD_T
+  curl_off_t bytes;
+  curl_easy_getinfo(rbce->curl, CURLINFO_SPEED_DOWNLOAD_T, &bytes);
+  return LL2NUM(bytes);
+#else
+  double bytes;
   curl_easy_getinfo(rbce->curl, CURLINFO_SPEED_DOWNLOAD, &bytes);
-
   return rb_float_new(bytes);
+#endif
 }
 
 /*
@@ -2797,7 +5233,7 @@ static VALUE ruby_curl_easy_header_size_get(VALUE self) {
   ruby_curl_easy *rbce;
   long size;
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
   curl_easy_getinfo(rbce->curl, CURLINFO_HEADER_SIZE, &size);
 
   return LONG2NUM(size);
@@ -2815,7 +5251,7 @@ static VALUE ruby_curl_easy_request_size_get(VALUE self) {
   ruby_curl_easy *rbce;
   long size;
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
   curl_easy_getinfo(rbce->curl, CURLINFO_REQUEST_SIZE, &size);
 
   return LONG2NUM(size);
@@ -2832,7 +5268,7 @@ static VALUE ruby_curl_easy_ssl_verify_result_get(VALUE self) {
   ruby_curl_easy *rbce;
   long result;
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
   curl_easy_getinfo(rbce->curl, CURLINFO_SSL_VERIFYRESULT, &result);
 
   return LONG2NUM(result);
@@ -2855,12 +5291,17 @@ NOTE: you must call curl_slist_free_all(3) on the list pointer once you're done
  */
 static VALUE ruby_curl_easy_downloaded_content_length_get(VALUE self) {
   ruby_curl_easy *rbce;
-  double bytes;
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+#ifdef HAVE_CURLINFO_CONTENT_LENGTH_DOWNLOAD_T
+  curl_off_t bytes;
+  curl_easy_getinfo(rbce->curl, CURLINFO_CONTENT_LENGTH_DOWNLOAD_T, &bytes);
+  return LL2NUM(bytes);
+#else
+  double bytes;
   curl_easy_getinfo(rbce->curl, CURLINFO_CONTENT_LENGTH_DOWNLOAD, &bytes);
-
   return rb_float_new(bytes);
+#endif
 }
 
 /*
@@ -2871,12 +5312,17 @@ static VALUE ruby_curl_easy_downloaded_content_length_get(VALUE self) {
  */
 static VALUE ruby_curl_easy_uploaded_content_length_get(VALUE self) {
   ruby_curl_easy *rbce;
-  double bytes;
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+#ifdef HAVE_CURLINFO_CONTENT_LENGTH_UPLOAD_T
+  curl_off_t bytes;
+  curl_easy_getinfo(rbce->curl, CURLINFO_CONTENT_LENGTH_UPLOAD_T, &bytes);
+  return LL2NUM(bytes);
+#else
+  double bytes;
   curl_easy_getinfo(rbce->curl, CURLINFO_CONTENT_LENGTH_UPLOAD, &bytes);
-
   return rb_float_new(bytes);
+#endif
 }
 
 /*
@@ -2892,7 +5338,7 @@ static VALUE ruby_curl_easy_content_type_get(VALUE self) {
   ruby_curl_easy *rbce;
   char* type;
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
   curl_easy_getinfo(rbce->curl, CURLINFO_CONTENT_TYPE, &type);
 
   if (type && type[0]) {    // curl returns empty string if none
@@ -2935,13 +5381,13 @@ static VALUE ruby_curl_easy_os_errno_get(VALUE self) {
   ruby_curl_easy *rbce;
   long result;
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
   curl_easy_getinfo(rbce->curl, CURLINFO_OS_ERRNO, &result);
 
   return LONG2NUM(result);
 #else
   rb_warn("Installed libcurl is too old to support os_errno");
-  return INT2FIX(0);
+  return LONG2NUM(0);
 #endif
 }
 
@@ -2964,23 +5410,59 @@ static VALUE ruby_curl_easy_num_connects_get(VALUE self) {
   ruby_curl_easy *rbce;
   long result;
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
   curl_easy_getinfo(rbce->curl, CURLINFO_NUM_CONNECTS, &result);
 
   return LONG2NUM(result);
 #else
   rb_warn("Installed libcurl is too old to support num_connects");
-  return INT2FIX(-1);
+  return LONG2NUM(-1);
 #endif
 }
 
 
-/* TODO this needs to be implemented.
+/*
+ * call-seq:
+ *   easy.cookielist                                => cookielist
+ *
+ * Retrieves the cookies curl knows in an array of strings.
+ * Returned strings are in Netscape cookiejar format or in Set-Cookie format.
+ * Since 7.43.0 cookies in the Set-Cookie format without a domain name are not exported.
+ *
+ * To modify the cookie engine (add/replace/remove), use +easy.cookielist= string+
+ * or +easy.set(:cookielist, string)+ with one of the following accepted inputs:
+ * - A Set-Cookie style header string: "Set-Cookie: name=value; Domain=example.com; Path=/; Expires=..."
+ * - One or more lines in Netscape cookie file format (tab-separated fields)
+ * - Special commands: "ALL" (clear all), "SESS" (remove session cookies), "FLUSH" (write to jar), "RELOAD" (reload from file)
+ *
+ * @see https://curl.se/libcurl/c/CURLINFO_COOKIELIST.html option <code>CURLINFO_COOKIELIST</code> of 
+ *   <code>curl_easy_getopt(3)</code> to see how libcurl behaves.
+ * @note requires libcurl 7.14.1 or higher, otherwise +-1+ is always returned
+ * @return [Array<String>, nil, -1] array of strings, or +nil+ if there are no cookies, or +-1+ if the libcurl version is too old
+*/
+static VALUE ruby_curl_easy_cookielist_get(VALUE self) {
+#ifdef HAVE_CURLINFO_COOKIELIST
+  ruby_curl_easy *rbce;
+  struct curl_slist *cookies;
+  struct curl_slist *cookie;
+  VALUE rb_cookies;
+
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
+  curl_easy_getinfo(rbce->curl, CURLINFO_COOKIELIST, &cookies);
+  if (!cookies)
+    return Qnil;
+  rb_cookies = rb_ary_new();
+  for (cookie = cookies; cookie; cookie = cookie->next)
+    rb_ary_push(rb_cookies, rb_str_new2(cookie->data));
+  curl_slist_free_all(cookies);
+  return rb_cookies;
 
-CURLINFO_COOKIELIST
+#else
+    rb_warn("Installed libcurl is too old to support cookielist");
+    return INT2FIX(-1);
+#endif
+}
 
-Pass a pointer to a 'struct curl_slist *' to receive a linked-list of all cookies cURL knows (expired ones, too). Don't forget to curl_slist_free_all(3) the list after it has been used. If there are no cookies (cookies for the handle have not been enabled or simply none have been received) 'struct curl_slist *' will be set to point to NULL. (Added in 7.14.1)
-*/
 
 /* TODO this needs to be implemented. Could probably support CONNECT_ONLY by having this
  *      return an open Socket or something.
@@ -3005,7 +5487,7 @@ static VALUE ruby_curl_easy_ftp_entry_path_get(VALUE self) {
   ruby_curl_easy *rbce;
   char* path = NULL;
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
   curl_easy_getinfo(rbce->curl, CURLINFO_FTP_ENTRY_PATH, &path);
 
   if (path && path[0]) {    // curl returns NULL or empty string if none
@@ -3014,7 +5496,7 @@ static VALUE ruby_curl_easy_ftp_entry_path_get(VALUE self) {
     return Qnil;
   }
 #else
-  rb_warn("Installed libcurl is too old to support num_connects");
+  rb_warn("Installed libcurl is too old to support ftp_entry_path");
   return Qnil;
 #endif
 }
@@ -3025,7 +5507,7 @@ static VALUE ruby_curl_easy_ftp_entry_path_get(VALUE self) {
  */
 static VALUE ruby_curl_easy_multi_get(VALUE self) {
   ruby_curl_easy *rbce;
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
   return rbce->multi;
 }
 
@@ -3035,7 +5517,28 @@ static VALUE ruby_curl_easy_multi_get(VALUE self) {
  */
 static VALUE ruby_curl_easy_multi_set(VALUE self, VALUE multi) {
   ruby_curl_easy *rbce;
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+  VALUE old_multi;
+  ruby_curl_multi *old_rbcm;
+  CURLMcode result;
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
+
+  if (!NIL_P(multi) && rb_obj_is_kind_of(multi, cCurlMulti) != Qtrue) {
+    rb_raise(rb_eTypeError, "expected Curl::Multi or nil");
+  }
+
+  old_multi = rbce->multi;
+  if (old_multi == multi) {
+    return rbce->multi;
+  }
+
+  old_rbcm = ruby_curl_multi_pointer_if_compatible(old_multi);
+  if (old_rbcm) {
+    result = rb_curl_multi_detach_easy(old_rbcm, rbce);
+    if (result != CURLM_OK) {
+      raise_curl_multi_error_exception(result);
+    }
+  }
+
   rbce->multi = multi;
   return rbce->multi;
 }
@@ -3046,21 +5549,44 @@ static VALUE ruby_curl_easy_multi_set(VALUE self, VALUE multi) {
  */
 static VALUE ruby_curl_easy_last_result(VALUE self) {
   ruby_curl_easy *rbce;
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
-  return INT2FIX(rbce->last_result);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
+  return LONG2NUM(rbce->last_result);
+}
+
+/*
+ * call-seq:
+ *   easy.last_error                                     => "Error details" or nil
+ */
+static VALUE ruby_curl_easy_last_error(VALUE self) {
+  ruby_curl_easy *rbce;
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
+
+  if (rbce->err_buf[0]) {    // curl returns NULL or empty string if none
+    return rb_str_new2(rbce->err_buf);
+  } else {
+    return Qnil;
+  }
 }
 
 /*
  * call-seq:
- *   easy.setopt Fixnum, value  => value
+ *   easy.setopt(opt, val)  => val
+ *
+ * Initial access to libcurl curl_easy_setopt
  *
- * Iniital access to libcurl curl_easy_setopt
+ * @param [Fixnum] opt The option to set, see +Curl::CURLOPT_*+ constants
+ * @param [Object] val
+ * @return [Object] val
+ * @raise [TypeError] if the option is not supported
+ * @note Some options - like url or cookie - aren't set directly throught +curl_easy_setopt+, but stored in the Ruby object state.
+ * @note When +curl_easy_setopt+ is called, return value is not checked here.
  */
 static VALUE ruby_curl_easy_set_opt(VALUE self, VALUE opt, VALUE val) {
   ruby_curl_easy *rbce;
-  long option = FIX2LONG(opt);
+  long option = NUM2LONG(opt);
+  rb_io_t *open_f_ptr;
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
 
   switch (option) {
   /* BEHAVIOR OPTIONS */
@@ -3082,9 +5608,11 @@ static VALUE ruby_curl_easy_set_opt(VALUE self, VALUE opt, VALUE val) {
   case CURLOPT_CUSTOMREQUEST:
     curl_easy_setopt(rbce->curl, CURLOPT_CUSTOMREQUEST, NIL_P(val) ? NULL : StringValueCStr(val));
     break;
-  case CURLOPT_HTTP_VERSION:
-    curl_easy_setopt(rbce->curl, CURLOPT_HTTP_VERSION, FIX2INT(val));
-    break;
+  case CURLOPT_HTTP_VERSION: {
+    long http_version = NIL_P(val) ? CURL_HTTP_VERSION_NONE : NUM2LONG(val);
+    rbce->http_version = http_version;
+    curl_easy_setopt(rbce->curl, CURLOPT_HTTP_VERSION, http_version);
+    } break;
   case CURLOPT_PROXY: {
     VALUE proxy_url = val;
     CURB_OBJECT_HSETTER(ruby_curl_easy, proxy_url);
@@ -3096,6 +5624,12 @@ static VALUE ruby_curl_easy_set_opt(VALUE self, VALUE opt, VALUE val) {
   case CURLOPT_HEADER:
   case CURLOPT_NOPROGRESS:
   case CURLOPT_NOSIGNAL:
+#ifdef HAVE_CURLOPT_PATH_AS_IS
+  case CURLOPT_PATH_AS_IS:
+#endif
+#ifdef HAVE_CURLOPT_PIPEWAIT
+  case CURLOPT_PIPEWAIT:
+#endif
   case CURLOPT_HTTPGET:
   case CURLOPT_NOBODY: {
     int type = rb_type(val);
@@ -3107,8 +5641,17 @@ static VALUE ruby_curl_easy_set_opt(VALUE self, VALUE opt, VALUE val) {
     } else {
       value = rb_funcall(val, rb_intern("to_i"), 0);
     }
-    curl_easy_setopt(rbce->curl, option, FIX2INT(value));
+    curl_easy_setopt(rbce->curl, option, NUM2LONG(value));
     } break;
+  case CURLOPT_POST: {
+    curl_easy_setopt(rbce->curl, CURLOPT_POST, rb_type(val) == T_TRUE);
+  } break;
+  case CURLOPT_MAXCONNECTS: {
+    curl_easy_setopt(rbce->curl, CURLOPT_MAXCONNECTS, NUM2LONG(val));
+  } break;
+  case CURLOPT_POSTFIELDS: {
+    ruby_curl_easy_post_body_set_with_mode(self, val, 0);
+  } break;
   case CURLOPT_USERPWD: {
     VALUE userpwd = val;
     CURB_OBJECT_HSETTER(ruby_curl_easy, userpwd);
@@ -3117,6 +5660,12 @@ static VALUE ruby_curl_easy_set_opt(VALUE self, VALUE opt, VALUE val) {
     VALUE proxypwd = val;
     CURB_OBJECT_HSETTER(ruby_curl_easy, proxypwd);
     } break;
+#ifdef HAVE_CURLOPT_NOPROXY
+  case CURLOPT_NOPROXY: {
+    VALUE noproxy = val;
+    CURB_OBJECT_HSETTER(ruby_curl_easy, noproxy);
+    } break;
+#endif
   case CURLOPT_COOKIE: {
     VALUE cookies = val;
     CURB_OBJECT_HSETTER(ruby_curl_easy, cookies);
@@ -3129,19 +5678,278 @@ static VALUE ruby_curl_easy_set_opt(VALUE self, VALUE opt, VALUE val) {
     VALUE cookiejar = val;
     CURB_OBJECT_HSETTER(ruby_curl_easy, cookiejar);
     } break;
+#ifdef HAVE_CURLOPT_REQUEST_TARGET
+  case CURLOPT_REQUEST_TARGET: {
+    /* Forward request-target directly to libcurl as a string. */
+    curl_easy_setopt(rbce->curl, CURLOPT_REQUEST_TARGET, NIL_P(val) ? NULL : StringValueCStr(val));
+    } break;
+#endif
+#ifdef HAVE_CURLOPT_DOH_URL
+  case CURLOPT_DOH_URL: {
+    rb_hash_aset(rbce->opts, rb_easy_hkey("doh_url"), val);
+    curl_easy_setopt(rbce->curl, CURLOPT_DOH_URL, NIL_P(val) ? NULL : StringValueCStr(val));
+    } break;
+#endif
+  case CURLOPT_TCP_NODELAY: {
+    curl_easy_setopt(rbce->curl, CURLOPT_TCP_NODELAY, NUM2LONG(val));
+    } break;
+  /* FTP-specific toggles */
+#ifdef HAVE_CURLOPT_DIRLISTONLY
+  case CURLOPT_DIRLISTONLY: {
+    int type = rb_type(val);
+    VALUE value;
+    if (type == T_TRUE) {
+      value = rb_int_new(1);
+    } else if (type == T_FALSE) {
+      value = rb_int_new(0);
+    } else {
+      value = rb_funcall(val, rb_intern("to_i"), 0);
+    }
+    curl_easy_setopt(rbce->curl, CURLOPT_DIRLISTONLY, NUM2LONG(value));
+    } break;
+#endif
+#ifdef HAVE_CURLOPT_FTP_USE_EPSV
+  case CURLOPT_FTP_USE_EPSV: {
+    int type = rb_type(val);
+    VALUE value;
+    if (type == T_TRUE) {
+      value = rb_int_new(1);
+    } else if (type == T_FALSE) {
+      value = rb_int_new(0);
+    } else {
+      value = rb_funcall(val, rb_intern("to_i"), 0);
+    }
+    curl_easy_setopt(rbce->curl, CURLOPT_FTP_USE_EPSV, NUM2LONG(value));
+    } break;
+#endif
+#ifdef HAVE_CURLOPT_FTP_USE_EPRT
+  case CURLOPT_FTP_USE_EPRT: {
+    int type = rb_type(val);
+    VALUE value;
+    if (type == T_TRUE) {
+      value = rb_int_new(1);
+    } else if (type == T_FALSE) {
+      value = rb_int_new(0);
+    } else {
+      value = rb_funcall(val, rb_intern("to_i"), 0);
+    }
+    curl_easy_setopt(rbce->curl, CURLOPT_FTP_USE_EPRT, NUM2LONG(value));
+    } break;
+#endif
+#ifdef HAVE_CURLOPT_FTP_SKIP_PASV_IP
+  case CURLOPT_FTP_SKIP_PASV_IP: {
+    int type = rb_type(val);
+    VALUE value;
+    if (type == T_TRUE) {
+      value = rb_int_new(1);
+    } else if (type == T_FALSE) {
+      value = rb_int_new(0);
+    } else {
+      value = rb_funcall(val, rb_intern("to_i"), 0);
+    }
+    curl_easy_setopt(rbce->curl, CURLOPT_FTP_SKIP_PASV_IP, NUM2LONG(value));
+    } break;
+#endif
+  case CURLOPT_RANGE: {
+    curl_easy_setopt(rbce->curl, CURLOPT_RANGE, StringValueCStr(val));
+    } break;
   case CURLOPT_RESUME_FROM: {
-    curl_easy_setopt(rbce->curl, CURLOPT_RESUME_FROM, FIX2LONG(val));
+    curl_easy_setopt(rbce->curl, CURLOPT_RESUME_FROM, NUM2LONG(val));
     } break;
   case CURLOPT_FAILONERROR: {
-    curl_easy_setopt(rbce->curl, CURLOPT_FAILONERROR, FIX2LONG(val));
+    curl_easy_setopt(rbce->curl, CURLOPT_FAILONERROR, NUM2LONG(val));
     } break;
-#if HAVE_CURLOPT_GSSAPI_DELEGATION
+  case CURLOPT_SSL_CIPHER_LIST: {
+    curl_easy_setopt(rbce->curl, CURLOPT_SSL_CIPHER_LIST, StringValueCStr(val));
+    } break;
+  case CURLOPT_FORBID_REUSE: {
+    rbce->forbid_reuse = NUM2LONG(val);
+    rbce->forbid_reuse_set = 1;
+    curl_easy_setopt(rbce->curl, CURLOPT_FORBID_REUSE, rbce->forbid_reuse);
+    } break;
+#ifdef HAVE_CURLOPT_GSSAPI_DELEGATION
   case CURLOPT_GSSAPI_DELEGATION: {
-    curl_easy_setopt(rbce->curl, CURLOPT_GSSAPI_DELEGATION, FIX2LONG(val));
+    curl_easy_setopt(rbce->curl, CURLOPT_GSSAPI_DELEGATION, NUM2LONG(val));
     } break;
 #endif
-  default:
+#ifdef HAVE_CURLOPT_UNIX_SOCKET_PATH
+  case CURLOPT_UNIX_SOCKET_PATH: {
+    rb_hash_aset(rbce->opts, rb_easy_hkey("unix_socket_path"), val);
+    curl_easy_setopt(rbce->curl, CURLOPT_UNIX_SOCKET_PATH, NIL_P(val) ? NULL : StringValueCStr(val));
+    } break;
+#endif
+#ifdef HAVE_CURLOPT_DNS_SERVERS
+  case CURLOPT_DNS_SERVERS: {
+    rb_hash_aset(rbce->opts, rb_easy_hkey("dns_servers"), val);
+    curl_easy_setopt(rbce->curl, CURLOPT_DNS_SERVERS, NIL_P(val) ? NULL : StringValueCStr(val));
+    } break;
+#endif
+#ifdef HAVE_CURLOPT_MAX_SEND_SPEED_LARGE
+  case CURLOPT_MAX_SEND_SPEED_LARGE: {
+    curl_easy_setopt(rbce->curl, CURLOPT_MAX_SEND_SPEED_LARGE, (curl_off_t) NUM2LL(val));
+    } break;
+#endif
+#ifdef HAVE_CURLOPT_MAX_RECV_SPEED_LARGE
+  case CURLOPT_MAX_RECV_SPEED_LARGE: {
+    curl_easy_setopt(rbce->curl, CURLOPT_MAX_RECV_SPEED_LARGE, (curl_off_t) NUM2LL(val));
+    } break;
+#endif
+#ifdef HAVE_CURLOPT_MAXFILESIZE
+  case CURLOPT_MAXFILESIZE:
+    curl_easy_setopt(rbce->curl, CURLOPT_MAXFILESIZE, NUM2LONG(val));
+    break;
+#endif
+#ifdef HAVE_CURLOPT_MAXFILESIZE_LARGE
+  case CURLOPT_MAXFILESIZE_LARGE:
+    curl_easy_setopt(rbce->curl, CURLOPT_MAXFILESIZE_LARGE, (curl_off_t)NUM2LL(val));
+    break;
+#endif
+#ifdef HAVE_CURLOPT_TCP_KEEPALIVE
+  case CURLOPT_TCP_KEEPALIVE:
+    curl_easy_setopt(rbce->curl, CURLOPT_TCP_KEEPALIVE, NUM2LONG(val));
+    break;
+  case CURLOPT_TCP_KEEPIDLE:
+    curl_easy_setopt(rbce->curl, CURLOPT_TCP_KEEPIDLE, NUM2LONG(val));
+    break;
+  case CURLOPT_TCP_KEEPINTVL:
+    curl_easy_setopt(rbce->curl, CURLOPT_TCP_KEEPINTVL, NUM2LONG(val));
+    break;
+#endif
+#ifdef HAVE_CURLOPT_HAPROXYPROTOCOL
+  case CURLOPT_HAPROXYPROTOCOL:
+    curl_easy_setopt(rbce->curl, CURLOPT_HAPROXYPROTOCOL, NUM2LONG(val));
+    break;
+#endif
+  case CURLOPT_STDERR:
+    // libcurl requires raw FILE pointer and this should be IO object in Ruby.
+    // Tempfile or StringIO won't work.
+    Check_Type(val, T_FILE);
+    GetOpenFile(val, open_f_ptr);
+    curl_easy_setopt(rbce->curl, CURLOPT_STDERR, rb_io_stdio_file(open_f_ptr));
+    /* Retain a Ruby reference to the IO to prevent GC/finalization
+     * while libcurl still holds and writes to the underlying FILE*. */
+    rb_easy_set("stderr_io", val);
+    break;
+  case CURLOPT_PROTOCOLS:
+  case CURLOPT_REDIR_PROTOCOLS:
+    curl_easy_setopt(rbce->curl, option, NUM2LONG(val));
+    break;
+#ifdef HAVE_CURLOPT_PROTOCOLS_STR
+  case CURLOPT_PROTOCOLS_STR:
+    curl_easy_setopt(rbce->curl, CURLOPT_PROTOCOLS_STR, NIL_P(val) ? NULL : StringValueCStr(val));
+    break;
+#endif
+#ifdef HAVE_CURLOPT_REDIR_PROTOCOLS_STR
+  case CURLOPT_REDIR_PROTOCOLS_STR:
+    curl_easy_setopt(rbce->curl, CURLOPT_REDIR_PROTOCOLS_STR, NIL_P(val) ? NULL : StringValueCStr(val));
+    break;
+#endif
+#ifdef HAVE_CURLOPT_SSL_SESSIONID_CACHE
+  case CURLOPT_SSL_SESSIONID_CACHE:
+    curl_easy_setopt(rbce->curl, CURLOPT_SSL_SESSIONID_CACHE, NUM2LONG(val));
+    break;
+#endif
+#ifdef HAVE_CURLOPT_COOKIELIST
+  case CURLOPT_COOKIELIST: {
+	/* Forward to libcurl */
+	curl_easy_setopt(rbce->curl, CURLOPT_COOKIELIST, StringValueCStr(val));
+	/* Track whether the cookie engine should be enabled for requests.
+	 * According to libcurl docs, CURLOPT_COOKIELIST also enables the cookie engine
+	 * when provided with a non-command string. Some environments may still require
+	 * an explicit "enable" via CURLOPT_COOKIEFILE="" to send cookies on requests.
+	 * We do that in the perform setup when this flag is set.
+	 */
+	if (RB_TYPE_P(val, T_STRING)) {
+	  const char *s = StringValueCStr(val);
+	  if (!(strcmp(s, "ALL") == 0 || strcmp(s, "SESS") == 0 || strcmp(s, "FLUSH") == 0 || strcmp(s, "RELOAD") == 0)) {
+	    rbce->cookielist_engine_enabled = 1;
+	  }
+	} else {
+	  /* Non-string values are unexpected; be conservative and do not enable. */
+	}
+  } break;
+#endif
+#ifdef HAVE_CURLOPT_PROXY_SSL_VERIFYHOST
+  case CURLOPT_PROXY_SSL_VERIFYHOST:
+    curl_easy_setopt(rbce->curl, CURLOPT_PROXY_SSL_VERIFYHOST, NUM2LONG(val));
+    break;
+#endif
+#ifdef HAVE_CURLOPT_DOH_SSL_VERIFYPEER
+  case CURLOPT_DOH_SSL_VERIFYPEER:
+    curl_easy_setopt(rbce->curl, CURLOPT_DOH_SSL_VERIFYPEER, NUM2LONG(val));
     break;
+#endif
+#ifdef HAVE_CURLOPT_DOH_SSL_VERIFYHOST
+  case CURLOPT_DOH_SSL_VERIFYHOST:
+    curl_easy_setopt(rbce->curl, CURLOPT_DOH_SSL_VERIFYHOST, NUM2LONG(val));
+    break;
+#endif
+#ifdef HAVE_CURLOPT_DOH_SSL_VERIFYSTATUS
+  case CURLOPT_DOH_SSL_VERIFYSTATUS:
+    curl_easy_setopt(rbce->curl, CURLOPT_DOH_SSL_VERIFYSTATUS, NUM2LONG(val));
+    break;
+#endif
+#ifdef HAVE_CURLOPT_RESOLVE
+  case CURLOPT_RESOLVE: {
+    struct curl_slist *list = NULL;
+    ruby_curl_easy_clear_resolve_list(rbce);
+    if (NIL_P(val)) {
+      /* When nil is passed, we clear any previous resolve list */
+      list = NULL;
+    } else if (TYPE(val) == T_ARRAY) {
+      long i, len = RARRAY_LEN(val);
+      for (i = 0; i < len; i++) {
+        VALUE item = rb_ary_entry(val, i);
+        struct curl_slist *new_list = curl_slist_append(list, StringValueCStr(item));
+        if (!new_list) {
+          curl_slist_free_all(list);
+          rb_raise(rb_eNoMemError, "Failed to append to resolve list");
+        }
+        list = new_list;
+      }
+    } else {
+      /* If a single string is passed, use it directly */
+      list = curl_slist_append(NULL, StringValueCStr(val));
+      if (!list) {
+        rb_raise(rb_eNoMemError, "Failed to create resolve list");
+      }
+    }
+    /* Save the list pointer in the ruby_curl_easy structure for cleanup later */
+    rbce->curl_resolve = list;
+    rb_hash_aset(rbce->opts, rb_easy_hkey("resolve"), val);
+    curl_easy_setopt(rbce->curl, CURLOPT_RESOLVE, list);
+  } break;
+#endif
+#ifdef HAVE_CURLOPT_CONNECT_TO
+  case CURLOPT_CONNECT_TO: {
+    struct curl_slist *list = NULL;
+    ruby_curl_easy_clear_connect_to_list(rbce);
+    if (NIL_P(val)) {
+      list = NULL;
+    } else if (TYPE(val) == T_ARRAY) {
+      long i, len = RARRAY_LEN(val);
+      for (i = 0; i < len; i++) {
+        VALUE item = rb_ary_entry(val, i);
+        struct curl_slist *new_list = curl_slist_append(list, StringValueCStr(item));
+        if (!new_list) {
+          curl_slist_free_all(list);
+          rb_raise(rb_eNoMemError, "Failed to append to connect-to list");
+        }
+        list = new_list;
+      }
+    } else {
+      list = curl_slist_append(NULL, StringValueCStr(val));
+      if (!list) {
+        rb_raise(rb_eNoMemError, "Failed to create connect-to list");
+      }
+    }
+    rbce->curl_connect_to = list;
+    rb_hash_aset(rbce->opts, rb_easy_hkey("connect_to"), val);
+    curl_easy_setopt(rbce->curl, CURLOPT_CONNECT_TO, list);
+  } break;
+#endif
+  default:
+    rb_raise(rb_eTypeError, "Curb unsupported option");
   }
 
   return val;
@@ -3149,9 +5957,13 @@ static VALUE ruby_curl_easy_set_opt(VALUE self, VALUE opt, VALUE val) {
 
 /*
  * call-seq:
- *   easy.getinfo Fixnum => value
+ *   easy.getinfo(opt) => nil
  *
  * Iniital access to libcurl curl_easy_getinfo, remember getinfo doesn't return the same values as setopt
+ *
+ * @note This method is not implemented yet.
+ * @param [Fixnum] code Constant +CURLINFO_*+ from libcurl
+ * @return [nil]
  */
 static VALUE ruby_curl_easy_get_opt(VALUE self, VALUE opt) {
   return Qnil;
@@ -3164,7 +5976,7 @@ static VALUE ruby_curl_easy_get_opt(VALUE self, VALUE opt) {
 static VALUE ruby_curl_easy_inspect(VALUE self) {
   char buf[64];
   ruby_curl_easy *rbce;
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
   /* if we don't have a url set... we'll crash... */
   if( !rb_easy_nil("url") && rb_easy_type_check("url", T_STRING)) {
     VALUE url = rb_easy_get("url");
@@ -3196,7 +6008,7 @@ static VALUE ruby_curl_easy_escape(VALUE self, VALUE svalue) {
   VALUE rresult;
   VALUE str = svalue;
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
 
   /* NOTE: make sure the value is a string, if not call to_s */
   if( rb_type(str) != T_STRING ) { str = rb_funcall(str,rb_intern("to_s"),0); }
@@ -3227,12 +6039,12 @@ static VALUE ruby_curl_easy_unescape(VALUE self, VALUE str) {
   char *result;
   VALUE rresult;
 
-  Data_Get_Struct(self, ruby_curl_easy, rbce);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
 
 #if (LIBCURL_VERSION_NUM >= 0x070f04)
   result = (char*)curl_easy_unescape(rbce->curl, StringValuePtr(str), (int)RSTRING_LEN(str), &rlen);
 #else
-  result = (char*)curl_unescape(StringValuePtr(str), RSTRING_LEN(str));
+  result = (char*)curl_unescape(StringValuePtr(str), (int)RSTRING_LEN(str));
   rlen = strlen(result);
 #endif
 
@@ -3247,18 +6059,21 @@ static VALUE ruby_curl_easy_unescape(VALUE self, VALUE str) {
 
 /*
  * call-seq:
- *   Curl::Easy.error(code)    => String
+ *   Curl::Easy.error(code)    => [ErrCode, String]
  *
  * translate an internal libcurl error to ruby error class
  */
 static VALUE ruby_curl_easy_error_message(VALUE klass, VALUE code) {
-  return rb_curl_easy_error(FIX2INT(code));
+  return rb_curl_easy_error(NUM2INT(code));
 }
 
 /* =================== INIT LIB =====================*/
+// TODO: https://bugs.ruby-lang.org/issues/18007
 void init_curb_easy() {
   idCall = rb_intern("call");
   idJoin = rb_intern("join");
+  idNetworkPolicyNone = rb_intern("none");
+  idNetworkPolicyPublic = rb_intern("public");
 
   rbstrAmp = rb_str_new2("&");
   rb_global_variable(&rbstrAmp);
@@ -3266,12 +6081,21 @@ void init_curb_easy() {
   cCurlEasy = rb_define_class_under(mCurl, "Easy", rb_cObject);
 
   /* Class methods */
-  rb_define_singleton_method(cCurlEasy, "new", ruby_curl_easy_new, -1);
+  rb_define_alloc_func(cCurlEasy, ruby_curl_easy_allocate);
   rb_define_singleton_method(cCurlEasy, "error", ruby_curl_easy_error_message, 1);
 
+  /* Initialize method */
+  rb_define_method(cCurlEasy, "initialize", ruby_curl_easy_initialize, -1);
+
   /* Attributes for config next perform */
   rb_define_method(cCurlEasy, "url", ruby_curl_easy_url_get, 0);
   rb_define_method(cCurlEasy, "proxy_url", ruby_curl_easy_proxy_url_get, 0);
+  rb_define_method(cCurlEasy, "http_version=", ruby_curl_easy_http_version_set, 1);
+  rb_define_method(cCurlEasy, "http_version", ruby_curl_easy_http_version_get, 0);
+
+  rb_define_method(cCurlEasy, "proxy_headers=", ruby_curl_easy_proxy_headers_set, 1);
+  rb_define_method(cCurlEasy, "proxy_headers", ruby_curl_easy_proxy_headers_get, 0);
+
   rb_define_method(cCurlEasy, "headers=", ruby_curl_easy_headers_set, 1);
   rb_define_method(cCurlEasy, "headers", ruby_curl_easy_headers_get, 0);
   rb_define_method(cCurlEasy, "interface", ruby_curl_easy_interface_get, 0);
@@ -3298,6 +6122,19 @@ void init_curb_easy() {
   rb_define_method(cCurlEasy, "put_data=", ruby_curl_easy_put_data_set, 1);
   rb_define_method(cCurlEasy, "ftp_commands=", ruby_curl_easy_ftp_commands_set, 1);
   rb_define_method(cCurlEasy, "ftp_commands", ruby_curl_easy_ftp_commands_get, 0);
+  rb_define_method(cCurlEasy, "resolve=", ruby_curl_easy_resolve_set, 1);
+  rb_define_method(cCurlEasy, "resolve", ruby_curl_easy_resolve_get, 0);
+  rb_define_method(cCurlEasy, "connect_to=", ruby_curl_easy_connect_to_set, 1);
+  rb_define_method(cCurlEasy, "connect_to", ruby_curl_easy_connect_to_get, 0);
+  rb_define_method(cCurlEasy, "doh_url=", ruby_curl_easy_doh_url_set, 1);
+  rb_define_method(cCurlEasy, "doh_url", ruby_curl_easy_doh_url_get, 0);
+#ifdef HAVE_CURLOPT_DNS_SERVERS
+  rb_define_method(cCurlEasy, "dns_servers", ruby_curl_easy_dns_servers_get, 0);
+#endif
+  rb_define_method(cCurlEasy, "allowed_cidrs=", ruby_curl_easy_allowed_cidrs_set, 1);
+  rb_define_method(cCurlEasy, "allowed_cidrs", ruby_curl_easy_allowed_cidrs_get, 0);
+  rb_define_method(cCurlEasy, "allowed_hosts=", ruby_curl_easy_allowed_hosts_set, 1);
+  rb_define_method(cCurlEasy, "allowed_hosts", ruby_curl_easy_allowed_hosts_get, 0);
 
   rb_define_method(cCurlEasy, "local_port=", ruby_curl_easy_local_port_set, 1);
   rb_define_method(cCurlEasy, "local_port", ruby_curl_easy_local_port_get, 0);
@@ -3315,8 +6152,12 @@ void init_curb_easy() {
   rb_define_method(cCurlEasy, "max_redirects", ruby_curl_easy_max_redirects_get, 0);
   rb_define_method(cCurlEasy, "timeout=", ruby_curl_easy_timeout_set, 1);
   rb_define_method(cCurlEasy, "timeout", ruby_curl_easy_timeout_get, 0);
+  rb_define_method(cCurlEasy, "timeout_ms=", ruby_curl_easy_timeout_ms_set, 1);
+  rb_define_method(cCurlEasy, "timeout_ms", ruby_curl_easy_timeout_ms_get, 0);
   rb_define_method(cCurlEasy, "connect_timeout=", ruby_curl_easy_connect_timeout_set, 1);
   rb_define_method(cCurlEasy, "connect_timeout", ruby_curl_easy_connect_timeout_get, 0);
+  rb_define_method(cCurlEasy, "connect_timeout_ms=", ruby_curl_easy_connect_timeout_ms_set, 1);
+  rb_define_method(cCurlEasy, "connect_timeout_ms", ruby_curl_easy_connect_timeout_ms_get, 0);
   rb_define_method(cCurlEasy, "dns_cache_timeout=", ruby_curl_easy_dns_cache_timeout_set, 1);
   rb_define_method(cCurlEasy, "dns_cache_timeout", ruby_curl_easy_dns_cache_timeout_get, 0);
   rb_define_method(cCurlEasy, "ftp_response_timeout=", ruby_curl_easy_ftp_response_timeout_set, 1);
@@ -3325,6 +6166,10 @@ void init_curb_easy() {
   rb_define_method(cCurlEasy, "low_speed_limit", ruby_curl_easy_low_speed_limit_get, 0);
   rb_define_method(cCurlEasy, "low_speed_time=", ruby_curl_easy_low_speed_time_set, 1);
   rb_define_method(cCurlEasy, "low_speed_time", ruby_curl_easy_low_speed_time_get, 0);
+  rb_define_method(cCurlEasy, "max_send_speed_large=", ruby_curl_easy_max_send_speed_large_set, 1);
+  rb_define_method(cCurlEasy, "max_send_speed_large", ruby_curl_easy_max_send_speed_large_get, 0);
+  rb_define_method(cCurlEasy, "max_recv_speed_large=", ruby_curl_easy_max_recv_speed_large_set, 1);
+  rb_define_method(cCurlEasy, "max_recv_speed_large", ruby_curl_easy_max_recv_speed_large_get, 0);
   rb_define_method(cCurlEasy, "ssl_version=", ruby_curl_easy_ssl_version_set, 1);
   rb_define_method(cCurlEasy, "ssl_version", ruby_curl_easy_ssl_version_get, 0);
   rb_define_method(cCurlEasy, "use_ssl=", ruby_curl_easy_use_ssl_set, 1);
@@ -3363,6 +6208,8 @@ void init_curb_easy() {
   rb_define_method(cCurlEasy, "ignore_content_length?", ruby_curl_easy_ignore_content_length_q, 0);
   rb_define_method(cCurlEasy, "resolve_mode", ruby_curl_easy_resolve_mode, 0);
   rb_define_method(cCurlEasy, "resolve_mode=", ruby_curl_easy_resolve_mode_set, 1);
+  rb_define_method(cCurlEasy, "network_policy", ruby_curl_easy_network_policy_get, 0);
+  rb_define_method(cCurlEasy, "network_policy=", ruby_curl_easy_network_policy_set, 1);
 
   rb_define_method(cCurlEasy, "on_body", ruby_curl_easy_on_body_set, -1);
   rb_define_method(cCurlEasy, "on_header", ruby_curl_easy_on_header_set, -1);
@@ -3376,14 +6223,18 @@ void init_curb_easy() {
 
   rb_define_method(cCurlEasy, "http", ruby_curl_easy_perform_verb, 1);
   rb_define_method(cCurlEasy, "http_post", ruby_curl_easy_perform_post, -1);
-  rb_define_method(cCurlEasy, "http_put", ruby_curl_easy_perform_put, 1);
+  rb_define_method(cCurlEasy, "http_put", ruby_curl_easy_perform_put, -1);
+  rb_define_method(cCurlEasy, "http_patch", ruby_curl_easy_perform_patch, -1);
 
   /* Post-perform info methods */
   rb_define_method(cCurlEasy, "body_str", ruby_curl_easy_body_str_get, 0);
+  rb_define_method(cCurlEasy, "max_body_bytes=", ruby_curl_easy_max_body_bytes_set, 1);
+  rb_define_method(cCurlEasy, "max_body_bytes", ruby_curl_easy_max_body_bytes_get, 0);
   rb_define_method(cCurlEasy, "header_str", ruby_curl_easy_header_str_get, 0);
 
   rb_define_method(cCurlEasy, "last_effective_url", ruby_curl_easy_last_effective_url_get, 0);
   rb_define_method(cCurlEasy, "response_code", ruby_curl_easy_response_code_get, 0);
+  rb_define_method(cCurlEasy, "code", ruby_curl_easy_response_code_get, 0);
 #if defined(HAVE_CURLINFO_PRIMARY_IP)
   rb_define_method(cCurlEasy, "primary_ip", ruby_curl_easy_primary_ip_get, 0);
 #endif
@@ -3412,6 +6263,7 @@ void init_curb_easy() {
   rb_define_method(cCurlEasy, "content_type", ruby_curl_easy_content_type_get, 0);
   rb_define_method(cCurlEasy, "os_errno", ruby_curl_easy_os_errno_get, 0);
   rb_define_method(cCurlEasy, "num_connects", ruby_curl_easy_num_connects_get, 0);
+  rb_define_method(cCurlEasy, "cookielist", ruby_curl_easy_cookielist_get, 0);
   rb_define_method(cCurlEasy, "ftp_entry_path", ruby_curl_easy_ftp_entry_path_get, 0);
 
   rb_define_method(cCurlEasy, "close", ruby_curl_easy_close, 0);
@@ -3428,7 +6280,16 @@ void init_curb_easy() {
 
   rb_define_method(cCurlEasy, "multi", ruby_curl_easy_multi_get, 0);
   rb_define_method(cCurlEasy, "multi=", ruby_curl_easy_multi_set, 1);
+  rb_define_private_method(cCurlEasy, "__curb_native_setup!", ruby_curl_easy_setup_self, 0);
+  rb_define_private_method(cCurlEasy, "__curb_allow_proxy=", ruby_curl_easy_allow_proxy_set, 1);
+  rb_define_private_method(cCurlEasy, "__curb_allow_unix_socket=", ruby_curl_easy_allow_unix_socket_set, 1);
+  rb_define_private_method(cCurlEasy, "_take_callback_error", ruby_curl_easy_take_callback_error, 0);
   rb_define_method(cCurlEasy, "last_result", ruby_curl_easy_last_result, 0);
+  rb_define_method(cCurlEasy, "last_error", ruby_curl_easy_last_error, 0);
+  rb_define_method(cCurlEasy, "unsafe_destination_error", ruby_curl_easy_unsafe_destination_error_get, 0);
+#ifdef HAVE_CURLOPT_UNIX_SOCKET_PATH
+  rb_define_method(cCurlEasy, "unix_socket_path", ruby_curl_easy_unix_socket_path_get, 0);
+#endif
 
   rb_define_method(cCurlEasy, "setopt", ruby_curl_easy_set_opt, 2);
   rb_define_method(cCurlEasy, "getinfo", ruby_curl_easy_get_opt, 1);