Added flags CURL_SSLVERSION_OR_UP_TO_* to CURLOPT_SSLVERSION #1166

jkralik · 2016-12-17T12:39:30Z

By this patch user/developer can setup range of TLS versions, that
he want to support by curl/libcurl.

curl: curl --tlsv1.1 --up-to-tls-default https://www.google.com
libcurl: curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1.1 | CURL_SSLVERSION_OR_UP_TO_DEFAULT);

mention-bot · 2016-12-17T12:39:33Z

@jkralik, thanks for your PR! By analyzing the history of the files in this pull request, we identified @jay, @kdudka and @bagder to be potential reviewers.

jay · 2016-12-17T22:31:56Z

OR_UP_TO doesn't seem too intuitive, why not something like --tlsmin 1.0 --tlsmax 1.2

bagder · 2016-12-18T16:10:53Z

Yeah, max sounds better to my ears as well rather than "or_up_to". I think that if --tlsmax 1.2 is used, the regular --tlsv* option would be treated as the minimum version. Right?

jkralik · 2016-12-18T16:27:52Z

Right. --tlsv* is treated as minimum. For tool I will rewrite args "up-to-tlsv1.2,..." as --tlsmax 1.2. Do you want to refactor name of flags too? Like CURL_SSLVERSION_OR_UP_TO_TLSv1.2 =>CURL_SSLVERSION_MAX_TLSv1.2

kdudka · 2016-12-19T14:42:36Z

Yes, CURL_SSLVERSION_MAX_TLSv1.2 sounds less cryptic to me.

kdudka · 2016-12-19T14:43:59Z

docs/cmdline-opts/tls-max.d

+Use up to TLSv1.2 . The supported minimum is tlsv1.0 or tlsv1.1.
+.IP "1.3"
+Use up to TLSv1.3 . The supported minimum is tlsv1.0 or tlsv1.1 or tlsv1.2.
+.RE


Do I understand it correctly that minimum and maximum cannot be set to the same value? Why?

Yes it is supported. But it is wired to tls-max with tlsvX.Y when you want to just tlsvX.Y. If you wish I can add this option to documentation.

I would drop all the "The supported minimum is ..." sentences from the particular options. The statement above says it clearly enough in a generic way. The fact that the minimum enabled TLS version cannot be higher than the maximum enabled TLS version is obvious. Also the space before comma appears disruptive to me.

I agree - removed sentences.

kdudka · 2016-12-19T14:46:06Z

lib/vtls/darwinssl.c

+      switch(ssl_version) {
+        case CURL_SSLVERSION_TLSv1_0:
+          return set_ssl_version_up_to(conn, sockindex, ssl_version,
+                                       CURL_SSLVERSION_OR_UP_TO_TLSv1_0);


Why do you recursively call the function? Would not it be enough to (re)assign ssl_version_up_to and continue the execution?

I agree. I will rewrite it as you suggest.

jkralik · 2017-01-16T13:54:10Z

Hi Kamil.
Please, would you look at the latest changes?
Is it ok, now?
Thx

kdudka · 2017-01-19T14:18:17Z

On Monday, January 16, 2017 05:54:11 Jozef Kralik wrote: Is it ok, now?

Not yet. Please rebase your branch on top of current upstream master branch. I have also a few review comments that I will attach to the code directly...

kdudka · 2017-01-19T14:24:51Z

docs/curl.1

+Use up to TLSv1.3 . The supported minimum is tlsv1.0 or tlsv1.1 or tlsv1.2.
+.RE
+
+See also \fI--tlsv1.0\fP and \fI--tlsv1.1\fP and \fI--tlsv1.2\fP. \fI--tls-max\fP requires that the underlying libcurl was built to support TLS. Added in 7.53.0.


Please break the line such that it does not exceed 79 columns, according to:
https://github.com/curl/curl/blob/master/docs/CODE_STYLE.md

docs/curl.1 is generated document by command: docs/cmdline-opts/gen.pl mainpage

kdudka · 2017-01-19T14:26:43Z

docs/libcurl/opts/CURLOPT_SSLVERSION.3

@@ -50,6 +50,18 @@ TLSv1.1 (Added in 7.34.0)
 TLSv1.2 (Added in 7.34.0)
 .IP CURL_SSLVERSION_TLSv1_3
 TLSv1.3 (Added in 7.52.0)
+.IP CURL_SSLVERSION_MAX_DEFAULT
+Use as flag with CURL_SSLVERSION_TLSv1_x and behavior is same as
+CURL_SSLVERSION_MAX_TLSv1_2.


Why is CURL_SSLVERSION_MAX_DEFAULT same as CURL_SSLVERSION_MAX_TLSv1_2? How would one ask libcurl to set the maximum TLS version to the TLS library default?

I look to libraries and they are three kinds:

supports to get/set default maximum: nss

maximum is not determined: openssl, gnutls, mbedtls

doesn't support: darwinSSL, polarssl, gskit

For 1. default is determined by library.
For 2. what is default? eg: library supports TLSv3, but TLSv2 in this time is recommended.
For 3. default must be determined by us.

My suggestion:
For 1. Function <Curl_ssl_evaluate_version_max> (renamed retrieve_ssl_version_max) calls function <Curl_ssl_get_default_max_version> that returns CURL_SSLVERSION_MAX_TLSvX for certain ssl library.
For 2. I suggest use behavior as in point 3.
For 3. <Curl_ssl_get_default_max_version> returns CURL_SSLVERSION_MAX_TLSv1_2.

What do you think?

Even if NSS was the only library that currently allows one to set sslver.max to TLS library default, it is still worth to have this feature exposed via libcurl API. We can hard-code it to TLSv1.2 for other libraries now and eventually implement propagation of the flag once other libraries introduce a similar API.

However, it needs to be hard-coded in libcurl implementation, not in its API/ABI. If both CURL_SSLVERSION_MAX_DEFAULT and CURL_SSLVERSION_MAX_TLSv1_2 were mapped to the same constant in libcurl API/ABI, it would be nearly impossible to change the default later on.

Now, CURL_SSLVERSION_MAX_DEFAULT is as separeted value and every library CURL_SSLVERSION_MAX_DEFAULT must serve self (NSS via SSL_VersionRangeGetDefault and others as CURL_SSLVERSION_MAX_TLSv1.2).

kdudka · 2017-01-19T14:29:17Z

include/curl/curl.h

+#define GET_CURL_SSLVERSION(x) (x & 0xffff)
+#define GET_CURL_SSLVERSION_MAX(x) (x & 0xffff0000)
+#define SET_CURL_SSLVERSION_MAX(x, val) \
+  CURL_SSLVERSION_MAX_##x = (val << 16)


You are changing a public header file. All the defines you introduce need to start with the CURL prefix.

kdudka · 2017-01-19T14:33:01Z

include/curl/curl.h

+  SET_CURL_SSLVERSION_MAX(TLSv1_3, 4),
+
+  SET_CURL_SSLVERSION_MAX(LAST,    5), /* never use, keep last */
+  SET_CURL_SSLVERSION_MAX(DEFAULT, 3)  /* = ..._OR_UP_TO_TLSv1_2 */


Looks wrong to me. If we changed the default in libcurl later on, all dependent software would need to be recompiled for the change to take effect. You need to assign a separate value for CURL_SSLVERSION_MAX_DEFAULT so that a rebuilt of (dynamically linked) libcurl is sufficient to change the default.

kdudka · 2017-01-19T14:39:02Z

lib/vtls/ssl_hlp.c

+      }
+  }
+  return ssl_version_max_default;
+}


Why are you introducing a new module for the helper function? It could be added to the vtls module, which all the crypto backends use already. To be honest, I am not convinced that such a helper function simplifies the code anyhow. At least in the nss backend it does not seem to be the case.

kdudka · 2017-01-19T14:41:10Z

lib/vtls/nss.c

+  }
+  return CURLE_OK;
+}
+


This drastically increases the code complexity, which is unnecessary IMO. I will propose a better approach once the API issues (namely CURL_SSLVERSION_MAX_DEFAULT) are resolved.

CURL_SSLVERSION_MAX_DEFAULT is now as separated value and for NSS it uses maximum version from SSL_VersionRangeGetDefault. For other libraries it is CURL_SSLVERSION_MAX_TLSv1.2.

By this patch user/developer can setup range of TLS versions, that he want to support by curl/libcurl.

CURL_SSLVERSION_OR_UP_TO_NONE, CURL_SSLVERSION_OR_UP_TO_FIRST, CURL_SSLVERSION_OR_UP_TO_TLSv1_0

By this patch user/developer can setup range of TLS versions, that he want to support by curl/libcurl.

For NSS it set enabled maximum version of this library For others it set CURL_SSLVERSION_MAX_TLSv1.2

jkralik · 2017-02-03T14:49:31Z

Hello folks. I drop Curl_ssl_retrieve_version_max and simplify the code similarly as Kamil for others backends.

kdudka · 2017-02-03T15:07:48Z

docs/libcurl/opts/CURLOPT_PROXY_SSLVERSION.3

+value from SSL library. Only library NSS currently allows to get
+maximum supported TLS version.
+(Added in 7.53.0)
+.IP CURL_SSLVERSION_MAX_TLSv1_1


Documentation for CURL_SSLVERSION_MAX_TLSv1_0 is missing.

kdudka · 2017-02-03T15:08:03Z

docs/libcurl/opts/CURLOPT_SSLVERSION.3

+value from SSL library. Only library NSS currently allows to get
+maximum supported TLS version.
+(Added in 7.53.0)
+.IP CURL_SSLVERSION_MAX_TLSv1_1


Same here. Documentation for CURL_SSLVERSION_MAX_TLSv1_0 is missing.

kdudka · 2017-02-03T15:32:29Z

src/tool_paramhlp.c

+  size_t i = 0;
+  if(!str)
+    return PARAM_REQUIRES_PARAMETER;
+  for(i = 0; i < sizeof(tls_max_array)/sizeof(tls_max_array[i]); i++) {


sizeof(tls_max_array)/sizeof(tls_max_array[0])

good point :)

kdudka · 2017-02-03T15:41:56Z

lib/vtls/darwinssl.c

+  if(ssl_version_max == CURL_SSLVERSION_MAX_NONE) {
+    ssl_version_max = ssl_version;
+  }
+


Should not we handle CURL_SSLVERSION_MAX_DEFAULT at this point?

iboukris · 2017-02-03T15:52:52Z

This is interesting work, btw why not make the tls version a bit-mask instead of min-max, so it would be possible to do things like '--tlsv1.0 --tlsv1.2' for example.
Is that the control that the tls api / protocol allows?

kdudka · 2017-02-03T15:56:05Z

lib/vtls/gtls.c

@@ -375,6 +375,98 @@ static gnutls_x509_crt_fmt_t do_file_type(const char *type)
  return -1;
 }

+#ifndef USE_GNUTLS_PRIORITY_SET_DIRECT
+static CURLcode
+set_ssl_version_min_max(int *protocol_priority, struct connectdata *conn)


This can lead to stack overflow if new TLS versions were added later on but size of the array not updated. Please make set_ssl_version_min_max() take size of the array as an argument and let it check the boundaries before writing to that array.

kdudka · 2017-02-03T15:56:57Z

lib/vtls/gtls.c

+    case CURL_SSLVERSION_TLSv1_2 | CURL_SSLVERSION_MAX_DEFAULT:
+      *prioritylist = GNUTLS_CIPHERS ":-VERS-SSL3.0:-VERS-TLS-ALL:"
+                      "+VERS-TLS1.2:" GNUTLS_SRP;
+      break;


I guess we should fail by default instead of pretending success.

By default returns func CURLE_SSL_CONNECT_ERROR

kdudka · 2017-02-03T16:00:32Z

lib/vtls/mbedtls.c

+  CURLcode result = CURLE_OK;
+  long ssl_version = SSL_CONN_CONFIG(version);
+  long ssl_version_max = SSL_CONN_CONFIG(version_max) >> 16;
+  if(ssl_version_max == CURL_SSLVERSION_MAX_NONE) {


The check is not going to work as expected because ssl_version_max is already shifted. You might also want to handle CURL_SSLVERSION_MAX_DEFAULT at this point.

kdudka · 2017-02-03T16:12:38Z

On Friday, February 03, 2017 07:52:53 Isaac Boukris wrote: This is interesting work, btw why not make the tls version a bit-mask instead of min-max, so it would be possible to do things like '--tlsv1.0 --tlsv1.2' for example. Is that the control that the tls api / protocol allows?

I will let TLS experts to answer your question regarding the protocol itself. I know that NSS uses the min/max range and so does Firefox, for example. It might be difficult to find a real world use case for a more complex API than the version range IMO. Kamil

fix of usin CURL_SSLVERSION_MAX_DEFAULT

y

iboukris · 2017-02-03T18:05:30Z

On Fri, Feb 3, 2017 at 6:12 PM, Kamil Dudka <notifications@github.com> wrote:

On Friday, February 03, 2017 07:52:53 Isaac Boukris wrote: > This is interesting work, btw why not make the tls version a bit-mask > instead of min-max, so it would be possible to do things like '--tlsv1.0 > --tlsv1.2' for example. Is that the control that the tls api / protocol > allows? I will let TLS experts to answer your question regarding the protocol itself. I know that NSS uses the min/max range and so does Firefox, for example. It might be difficult to find a real world use case for a more complex API than the version range IMO.

Makes sense, thanks.

kdudka · 2017-02-06T19:29:10Z

Looks good to me. Thanks for all the fixes! As it is two weeks after devel freeze now, I propose to wait till curl-7.53.0 is out, then rebase on top of upstream and push. Additional review comments are welcome!

kdudka · 2017-02-27T13:43:13Z

I have squashed the commits and rebased against latest upstream. The result is available in the tls-max branch of my git repo: kdudka/curl@master...tls-max

Are we ready to merge this upstream?

jkralik · 2017-02-27T15:00:16Z

Hi Kamil. Do we want to set version "7.53.0" in documentation (and not "7.54.0") ?

kdudka · 2017-02-27T23:05:19Z

Good point. 7.53.0 needs to be substituted by 7.54.0 everywhere in the patch.

jkralik · 2017-02-28T07:28:53Z

I create a patch (attached) to fix it for https://github.com/kdudka/curl/tree/tls-max. and I agree with merge.

0001-fixup-docs-set-right-version-for-specify-range-of-en.txt

This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes curl#1166

kdudka · 2017-03-01T11:06:57Z

Thanks for the update! I have squashed all the fixup commits:
kdudka/curl@master...tls-max

@bagder are you fine with merging it upstream as it is?

This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes curl#1166

kdudka · 2017-03-08T09:44:35Z

Rebased on top of upstream.

bagder · 2017-03-08T13:29:07Z

LGTM, ready to merge. When merged, this will make the next release truly become "7.54.0"

kdudka · 2017-03-08T14:51:24Z

I have appended one more fixup to sync packages/OS400/curl.inc.in: kdudka@e8ef23d9

jkralik mentioned this pull request Dec 17, 2016

Add support for minimal TLS 1.x version of protocol #1136

Closed

kdudka reviewed Dec 19, 2016

View reviewed changes

bagder added the TLS label Dec 19, 2016

kdudka reviewed Jan 19, 2017

View reviewed changes

Jozef Kralik added 13 commits January 24, 2017 14:31

tls-max: Added flags CURL_SSLVERSION_OR_UP_TO_* to CURLOPT_SSLVERSION

21143bc

By this patch user/developer can setup range of TLS versions, that he want to support by curl/libcurl.

fix of SPACEBEFOREPAREN

03918ee

added missing symbols in versions:

8a5b3ab

CURL_SSLVERSION_OR_UP_TO_NONE, CURL_SSLVERSION_OR_UP_TO_FIRST, CURL_SSLVERSION_OR_UP_TO_TLSv1_0

fix documentation and added curl.1

007fc8c

fix of help: renamed up-to-tls-tlsv to up-to-tlsv

d90c799

refactoring tool curl: tls-max instead of up-to-tls*

b48f5cb

refactor: rename CURL_SSLVERSION_OR_UP_TO* to CURL_SSLVERSION_MAX*

c38fb2a

refactoring: remove recursion from set_ssl_version_min_max

dc572c9

Added flags CURL_SSLVERSION_OR_UP_TO_* to CURLOPT_SSLVERSION

e4ae8ba

By this patch user/developer can setup range of TLS versions, that he want to support by curl/libcurl.

Removing unnecessary sentences about minimum SSL versions

1521c82

Renaming GET/SET_CURL_SSLVERSION to CURL_GET/SET_SSLVERSION

f43ce22

CURL_SSLVERSION_MAX_DEFAULT with own value.

2526749

For NSS it set enabled maximum version of this library For others it set CURL_SSLVERSION_MAX_TLSv1.2

Added recent documentation

6cd599d

kdudka and others added 2 commits February 3, 2017 11:06

nss: simplify the code of SSL version mapping

0523638

simplify sets min, max of ssl version in ssl libraries

0b7992f

kdudka reviewed Feb 3, 2017

View reviewed changes

Jozef Kralik added 3 commits February 3, 2017 17:27

fix of shifts

426d1cd

fix of usin CURL_SSLVERSION_MAX_DEFAULT

fix of doc: added CURL_SSLVERSION_MAX_TLSv1_0

9812598

use first member to calc size of array

5a2477f

y

fix of windows compilation

ff5bb77

kdudka pushed a commit to kdudka/curl that referenced this pull request Mar 1, 2017

vtls: add options to specify range of enabled TLS versions

87a6a97

This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes curl#1166

kdudka pushed a commit to kdudka/curl that referenced this pull request Mar 8, 2017

vtls: add options to specify range of enabled TLS versions

869c315

This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes curl#1166

kdudka closed this in 6448f98 Mar 8, 2017

lock bot locked as resolved and limited conversation to collaborators Jan 19, 2019

Added flags CURL_SSLVERSION_OR_UP_TO_* to CURLOPT_SSLVERSION #1166

Added flags CURL_SSLVERSION_OR_UP_TO_* to CURLOPT_SSLVERSION #1166

Conversation

jkralik commented Dec 17, 2016

mention-bot commented Dec 17, 2016

jay commented Dec 17, 2016

bagder commented Dec 18, 2016

jkralik commented Dec 18, 2016 • edited

kdudka commented Dec 19, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jkralik commented Jan 16, 2017

kdudka commented Jan 19, 2017 via email

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kdudka Jan 19, 2017 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jkralik commented Feb 3, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kdudka Feb 3, 2017 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

iboukris commented Feb 3, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kdudka commented Feb 3, 2017 via email

iboukris commented Feb 3, 2017 via email

kdudka commented Feb 6, 2017

kdudka commented Feb 27, 2017

jkralik commented Feb 27, 2017

kdudka commented Feb 27, 2017

jkralik commented Feb 28, 2017

kdudka commented Mar 1, 2017

kdudka commented Mar 8, 2017

bagder commented Mar 8, 2017

kdudka commented Mar 8, 2017

jkralik commented Dec 18, 2016 •

edited

kdudka Jan 19, 2017 •

edited

kdudka Feb 3, 2017 •

edited