From 6032b8f2a22aa5af3cc99ceaf67311b19b6dddd1 Mon Sep 17 00:00:00 2001
From: x2018 <xkernel.wang@foxmail.com>
Date: Wed, 22 Oct 2025 21:45:07 +0800
Subject: [PATCH] vtls: unify the error handling in ssl_cf_connect().

Check preference at first, then init peer and do connect. Also fixes
CF_DATA_RESTORE.

Closes #19196
---
 lib/vtls/vtls.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
index 7ee9699dbf..115559b70d 100644
--- a/lib/vtls/vtls.c
+++ b/lib/vtls/vtls.c
@@ -1365,6 +1365,15 @@ static CURLcode ssl_cf_connect(struct Curl_cfilter *cf,
   DEBUGASSERT(connssl);
 
   *done = FALSE;
+
+  if(!connssl->prefs_checked) {
+    if(!ssl_prefs_check(data)) {
+      result = CURLE_SSL_CONNECT_ERROR;
+      goto out;
+    }
+    connssl->prefs_checked = TRUE;
+  }
+
   if(!connssl->peer.hostname) {
     char tls_id[80];
     connssl->ssl_impl->version(tls_id, sizeof(tls_id) - 1);
@@ -1373,12 +1382,6 @@ static CURLcode ssl_cf_connect(struct Curl_cfilter *cf,
       goto out;
   }
 
-  if(!connssl->prefs_checked) {
-    if(!ssl_prefs_check(data))
-      return CURLE_SSL_CONNECT_ERROR;
-    connssl->prefs_checked = TRUE;
-  }
-
   result = connssl->ssl_impl->do_connect(cf, data, done);
 
   if(!result && *done) {