Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Added flags CURL_SSLVERSION_OR_UP_TO_* to CURLOPT_SSLVERSION #1166

Closed
wants to merge 25 commits into from
Closed

Added flags CURL_SSLVERSION_OR_UP_TO_* to CURLOPT_SSLVERSION #1166

Show file tree
Hide file tree
Changes from 21 commits
Commits
Show all changes
25 commits
Select commit Hold shift + click to select a range
21143bc
tls-max: Added flags CURL_SSLVERSION_OR_UP_TO_* to CURLOPT_SSLVERSION
Dec 13, 2016
03918ee
fix of SPACEBEFOREPAREN
Dec 17, 2016
8a5b3ab
added missing symbols in versions:
Dec 17, 2016
007fc8c
fix documentation and added curl.1
Dec 17, 2016
d90c799
fix of help: renamed up-to-tls-tlsv to up-to-tlsv
Dec 17, 2016
b48f5cb
refactoring tool curl: tls-max instead of up-to-tls*
Dec 18, 2016
c38fb2a
refactor: rename CURL_SSLVERSION_OR_UP_TO* to CURL_SSLVERSION_MAX*
Dec 19, 2016
dc572c9
refactoring: remove recursion from set_ssl_version_min_max
Dec 20, 2016
e4ae8ba
Added flags CURL_SSLVERSION_OR_UP_TO_* to CURLOPT_SSLVERSION
Dec 13, 2016
1521c82
Removing unnecessary sentences about minimum SSL versions
Jan 23, 2017
f43ce22
Renaming GET/SET_CURL_SSLVERSION to CURL_GET/SET_SSLVERSION
Jan 23, 2017
2526749
CURL_SSLVERSION_MAX_DEFAULT with own value.
Jan 23, 2017
6cd599d
Added recent documentation
Jan 23, 2017
352116f
Added missing symbols (symbols-in-versions)
Jan 24, 2017
f28e480
Fix of documentation
Jan 25, 2017
8d5756e
Removing docs/curl.1
Jan 26, 2017
f178c42
removed macro CURL_SET_SSLVERSION_MAX
Jan 27, 2017
a218844
CURL_GET_SSLVERSION, CURL_GET_SSLVERSION removed
Jan 27, 2017
fbdab0a
curl.h: assign CURL_SSLVERSION_MAX_* constants systematically
kdudka Feb 1, 2017
0523638
nss: simplify the code of SSL version mapping
kdudka Feb 1, 2017
0b7992f
simplify sets min, max of ssl version in ssl libraries
Feb 3, 2017
426d1cd
fix of shifts
Feb 3, 2017
9812598
fix of doc: added CURL_SSLVERSION_MAX_TLSv1_0
Feb 3, 2017
5a2477f
use first member to calc size of array
Feb 3, 2017
ff5bb77
fix of windows compilation
Feb 11, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
24 changes: 24 additions & 0 deletions docs/cmdline-opts/tls-max.d
View file
Open in desktop
@@ -0,0 +1,24 @@
Long: tls-max
Arg: <VERSION>
Tags: Versions
Protocols: SSL
Added: 7.53.0
Requires: TLS
See-also: tlsv1.0 tlsv1.1 tlsv1.2
Help: Use TLSv1.0 or greater
---
VERSION defines maximum supported TLS version. A minimum is defined
by arguments tlsv1.0 or tlsv1.1 or tlsv1.2.

.RS
.IP "default"
Use up to recommended TLS version.
.IP "1.0"
Use up to TLSv1.0.
.IP "1.1"
Use up to TLSv1.1.
.IP "1.2"
Use up to TLSv1.2.
.IP "1.3"
Use up to TLSv1.3.
.RE
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do I understand it correctly that minimum and maximum cannot be set to the same value? Why?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes it is supported. But it is wired to tls-max with tlsvX.Y when you want to just tlsvX.Y. If you wish I can add this option to documentation.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would drop all the "The supported minimum is ..." sentences from the particular options. The statement above says it clearly enough in a generic way. The fact that the minimum enabled TLS version cannot be higher than the maximum enabled TLS version is obvious. Also the space before comma appears disruptive to me.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree - removed sentences.

17 changes: 16 additions & 1 deletion docs/libcurl/opts/CURLOPT_PROXY_SSLVERSION.3
View file
Open in desktop
Expand Up @@ -46,6 +46,20 @@ TLSv1.1
TLSv1.2
.IP CURL_SSLVERSION_TLSv1_3
TLSv1.3
.IP CURL_SSLVERSION_MAX_DEFAULT
The flag defines maximum supported TLS version as TLSv1.2 or default
value from SSL library. Only library NSS currently allows to get
maximum supported TLS version.
(Added in 7.53.0)
.IP CURL_SSLVERSION_MAX_TLSv1_1
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Documentation for CURL_SSLVERSION_MAX_TLSv1_0 is missing.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed

The flag defines maximum supported TLS version as TLSv1.1.
(Added in 7.53.0)
.IP CURL_SSLVERSION_MAX_TLSv1_2
The flag defines maximum supported TLS version as TLSv1.2.
(Added in 7.53.0)
.IP CURL_SSLVERSION_MAX_TLSv1_3
The flag defines maximum supported TLS version as TLSv1.3.
(Added in 7.53.0)
.RE
.SH DEFAULT
CURL_SSLVERSION_DEFAULT
Expand All @@ -58,7 +72,8 @@ if(curl) {
curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");

/* ask libcurl to use TLS version 1.0 or later */
curl_easy_setopt(curl, CURLOPT_PROXY_SSLVERSION, CURL_SSLVERSION_TLSv1);
curl_easy_setopt(curl, CURLOPT_PROXY_SSLVERSION, CURL_SSLVERSION_TLSv1_1 |
CURL_SSLVERSION_MAX_DEFAULT);

/* Perform the request */
curl_easy_perform(curl);
Expand Down
19 changes: 17 additions & 2 deletions docs/libcurl/opts/CURLOPT_SSLVERSION.3
View file
Open in desktop
Expand Up @@ -50,6 +50,20 @@ TLSv1.1 (Added in 7.34.0)
TLSv1.2 (Added in 7.34.0)
.IP CURL_SSLVERSION_TLSv1_3
TLSv1.3 (Added in 7.52.0)
.IP CURL_SSLVERSION_MAX_DEFAULT
The flag defines maximum supported TLS version as TLSv1.2 or default
value from SSL library. Only library NSS currently allows to get
maximum supported TLS version.
(Added in 7.53.0)
.IP CURL_SSLVERSION_MAX_TLSv1_1
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here. Documentation for CURL_SSLVERSION_MAX_TLSv1_0 is missing.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed

The flag defines maximum supported TLS version as TLSv1.1.
(Added in 7.53.0)
.IP CURL_SSLVERSION_MAX_TLSv1_2
The flag defines maximum supported TLS version as TLSv1.2.
(Added in 7.53.0)
.IP CURL_SSLVERSION_MAX_TLSv1_3
The flag defines maximum supported TLS version as TLSv1.3.
(Added in 7.53.0)
.RE
.SH DEFAULT
CURL_SSLVERSION_DEFAULT
Expand All @@ -61,8 +75,9 @@ CURL *curl = curl_easy_init();
if(curl) {
curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");

/* ask libcurl to use TLS version 1.0 or later */
curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1);
/* ask libcurl to use TLS version 1.1 or later */
curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1.1 |
CURL_SSLVERSION_MAX_DEFAULT);

/* Perform the request */
curl_easy_perform(curl);
Expand Down
6 changes: 6 additions & 0 deletions docs/libcurl/symbols-in-versions
View file
Open in desktop
Expand Up @@ -798,6 +798,12 @@ CURL_SSLVERSION_TLSv1_0 7.34.0
CURL_SSLVERSION_TLSv1_1 7.34.0
CURL_SSLVERSION_TLSv1_2 7.34.0
CURL_SSLVERSION_TLSv1_3 7.52.0
CURL_SSLVERSION_MAX_NONE 7.53.0
CURL_SSLVERSION_MAX_DEFAULT 7.53.0
CURL_SSLVERSION_MAX_TLSv1_0 7.53.0
CURL_SSLVERSION_MAX_TLSv1_1 7.53.0
CURL_SSLVERSION_MAX_TLSv1_2 7.53.0
CURL_SSLVERSION_MAX_TLSv1_3 7.53.0
CURL_TIMECOND_IFMODSINCE 7.9.7
CURL_TIMECOND_IFUNMODSINCE 7.9.7
CURL_TIMECOND_LASTMOD 7.9.7
Expand Down
12 changes: 12 additions & 0 deletions include/curl/curl.h
View file
Open in desktop
Expand Up @@ -1884,6 +1884,18 @@ enum {
CURL_SSLVERSION_LAST /* never use, keep last */
};

enum {
CURL_SSLVERSION_MAX_NONE = 0,
CURL_SSLVERSION_MAX_DEFAULT = (CURL_SSLVERSION_TLSv1 << 16),
CURL_SSLVERSION_MAX_TLSv1_0 = (CURL_SSLVERSION_TLSv1_0 << 16),
CURL_SSLVERSION_MAX_TLSv1_1 = (CURL_SSLVERSION_TLSv1_1 << 16),
CURL_SSLVERSION_MAX_TLSv1_2 = (CURL_SSLVERSION_TLSv1_2 << 16),
CURL_SSLVERSION_MAX_TLSv1_3 = (CURL_SSLVERSION_TLSv1_3 << 16),

/* never use, keep last */
CURL_SSLVERSION_MAX_LAST = (CURL_SSLVERSION_LAST << 16)
};

enum CURL_TLSAUTH {
CURL_TLSAUTH_NONE,
CURL_TLSAUTH_SRP,
Expand Down
11 changes: 9 additions & 2 deletions lib/url.c
View file
Open in desktop
Expand Up @@ -690,6 +690,9 @@ CURLcode Curl_open(struct Curl_easy **curl)
return result;
}

#define C_SSLVERSION_VALUE(x) (x & 0xffff)
#define C_SSLVERSION_MAX_VALUE(x) (x & 0xffff0000)

CURLcode Curl_setopt(struct Curl_easy *data, CURLoption option,
va_list param)
{
Expand Down Expand Up @@ -922,7 +925,9 @@ CURLcode Curl_setopt(struct Curl_easy *data, CURLoption option,
* implementations are lame.
*/
#ifdef USE_SSL
data->set.ssl.primary.version = va_arg(param, long);
arg = va_arg(param, long);
data->set.ssl.primary.version = C_SSLVERSION_VALUE(arg);
data->set.ssl.primary.version_max = C_SSLVERSION_MAX_VALUE(arg);
#else
result = CURLE_UNKNOWN_OPTION;
#endif
Expand All @@ -933,7 +938,9 @@ CURLcode Curl_setopt(struct Curl_easy *data, CURLoption option,
* implementations are lame.
*/
#ifdef USE_SSL
data->set.proxy_ssl.primary.version = va_arg(param, long);
arg = va_arg(param, long);
data->set.proxy_ssl.primary.version = C_SSLVERSION_VALUE(arg);
data->set.proxy_ssl.primary.version_max = C_SSLVERSION_MAX_VALUE(arg);
#else
result = CURLE_UNKNOWN_OPTION;
#endif
Expand Down
1 change: 1 addition & 0 deletions lib/urldata.h
View file
Open in desktop
Expand Up @@ -348,6 +348,7 @@ struct ssl_connect_data {

struct ssl_primary_config {
long version; /* what version the client wants to use */
long version_max; /* max supported version the client wants to use*/
bool verifypeer; /* set TRUE if this is desired */
bool verifyhost; /* set TRUE if CN/SAN must match hostname */
bool verifystatus; /* set TRUE if certificate status must be checked */
Expand Down
6 changes: 6 additions & 0 deletions lib/vtls/axtls.c
View file
Open in desktop
Expand Up @@ -156,6 +156,12 @@ static CURLcode connect_prep(struct connectdata *conn, int sockindex)
same connection */
return CURLE_OK;

if(SSL_CONN_CONFIG(version_max) != CURL_SSLVERSION_MAX_NONE) {
failf(data, "axtls does not support CURL_SSLVERSION_MAX");
return CURLE_SSL_CONNECT_ERROR;
}


/* axTLS only supports TLSv1 */
/* check to see if we've been told to use an explicit SSL/TLS version */
switch(SSL_CONN_CONFIG(version)) {
Expand Down
5 changes: 5 additions & 0 deletions lib/vtls/cyassl.c
View file
Open in desktop
Expand Up @@ -149,6 +149,11 @@ cyassl_connect_step1(struct connectdata *conn,
if(conssl->state == ssl_connection_complete)
return CURLE_OK;

if(SSL_CONN_CONFIG(version_max) != CURL_SSLVERSION_MAX_NONE) {
failf(data, "CyaSSL does not support to set maximum SSL/TLS version");
return CURLE_SSL_CONNECT_ERROR;
}

/* check to see if we've been told to use an explicit SSL/TLS version */
switch(SSL_CONN_CONFIG(version)) {
case CURL_SSLVERSION_DEFAULT:
Expand Down
135 changes: 110 additions & 25 deletions lib/vtls/darwinssl.c
View file
Open in desktop
Expand Up @@ -1042,6 +1042,101 @@ CF_INLINE bool is_file(const char *filename)
return false;
}

#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
static CURLcode darwinssl_version_from_curl(long *darwinver, long version)
{
switch(ssl_version) {
case CURL_SSLVERSION_TLSv1_0:
*darwinver = kTLSProtocol1;
return CURLE_OK;
case CURL_SSLVERSION_TLSv1_1:
*darwinver = kTLSProtocol11;
return CURLE_OK;
case CURL_SSLVERSION_TLSv1_2:
*darwinver = kTLSProtocol12;
return CURLE_OK;
case CURL_SSLVERSION_TLSv1_3:
break;
}
return CURLE_SSL_CONNECT_ERROR;
}
#endif

static CURLcode
set_ssl_version_min_max(struct connectdata *conn, int sockindex)
{
struct Curl_easy *data = conn->data;
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
long ssl_version = SSL_CONN_CONFIG(version);
long ssl_version_max = SSL_CONN_CONFIG(version_max) >> 16;
switch(ssl_version) {
case CURL_SSLVERSION_DEFAULT:
case CURL_SSLVERSION_TLSv1:
ssl_version = CURL_SSLVERSION_TLSv1_0;
ssl_version_max = CURL_SSLVERSION_MAX_TLSv1_2;
break;
}
if(ssl_version_max == CURL_SSLVERSION_MAX_NONE) {
ssl_version_max = ssl_version;
}

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should not we handle CURL_SSLVERSION_MAX_DEFAULT at this point?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed

#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
if(SSLSetProtocolVersionMax != NULL) {
SSLProtocol darwin_ver_min = kTLSProtocol1;
SSLProtocol darwin_ver_max = kTLSProtocol1;
CURLcode result = darwinssl_version_from_curl(&darwin_ver_min,
ssl_version);
if(result) {
failf(data, "unsupported min version passed via CURLOPT_SSLVERSION");
return result;
}
result = darwinssl_version_from_curl(&darwin_ver_max, ssl_version_max);
if(result) {
failf(data, "unsupported max version passed via CURLOPT_SSLVERSION");
return result;
}

(void)SSLSetProtocolVersionMin(connssl->ssl_ctx, darwin_ver_min);
(void)SSLSetProtocolVersionMax(connssl->ssl_ctx, darwin_ver_max);
return result;
}
else {
#if CURL_SUPPORT_MAC_10_8
long i = ssl_version;
(void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx,
kSSLProtocolAll,
false);
for(;i <= (ssl_version_max >> 16);i++) {
switch(i) {
case CURL_SSLVERSION_TLSv1_0:
(void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx,
kTLSProtocol1,
true);
break;
case CURL_SSLVERSION_TLSv1_1:
(void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx,
kTLSProtocol11,
true);
break;
case CURL_SSLVERSION_TLSv1_2:
(void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx,
kTLSProtocol12,
true);
break;
case CURL_SSLVERSION_TLSv1_3:
failf(data, "DarwinSSL: TLS 1.3 is not yet supported");
return CURLE_SSL_CONNECT_ERROR;
}
}
return CURLE_OK;
#endif /* CURL_SUPPORT_MAC_10_8 */
}
#endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */
failf(data, "DarwinSSL: cannot set SSL protocol");
return CURLE_SSL_CONNECT_ERROR;
}


static CURLcode darwinssl_connect_step1(struct connectdata *conn,
int sockindex)
{
Expand Down Expand Up @@ -1111,20 +1206,14 @@ static CURLcode darwinssl_connect_step1(struct connectdata *conn,
(void)SSLSetProtocolVersionMax(connssl->ssl_ctx, kTLSProtocol12);
break;
case CURL_SSLVERSION_TLSv1_0:
(void)SSLSetProtocolVersionMin(connssl->ssl_ctx, kTLSProtocol1);
(void)SSLSetProtocolVersionMax(connssl->ssl_ctx, kTLSProtocol1);
break;
case CURL_SSLVERSION_TLSv1_1:
(void)SSLSetProtocolVersionMin(connssl->ssl_ctx, kTLSProtocol11);
(void)SSLSetProtocolVersionMax(connssl->ssl_ctx, kTLSProtocol11);
break;
case CURL_SSLVERSION_TLSv1_2:
(void)SSLSetProtocolVersionMin(connssl->ssl_ctx, kTLSProtocol12);
(void)SSLSetProtocolVersionMax(connssl->ssl_ctx, kTLSProtocol12);
break;
case CURL_SSLVERSION_TLSv1_3:
failf(data, "DarwinSSL: TLS 1.3 is not yet supported");
return CURLE_SSL_CONNECT_ERROR;
{
CURLcode result = set_ssl_version_min_max(conn, sockindex);
if(result != CURLE_OK)
return result;
} break;
case CURL_SSLVERSION_SSLv3:
err = SSLSetProtocolVersionMin(connssl->ssl_ctx, kSSLProtocol3);
if(err != noErr) {
Expand Down Expand Up @@ -1165,23 +1254,14 @@ static CURLcode darwinssl_connect_step1(struct connectdata *conn,
true);
break;
case CURL_SSLVERSION_TLSv1_0:
(void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx,
kTLSProtocol1,
true);
break;
case CURL_SSLVERSION_TLSv1_1:
(void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx,
kTLSProtocol11,
true);
break;
case CURL_SSLVERSION_TLSv1_2:
(void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx,
kTLSProtocol12,
true);
break;
case CURL_SSLVERSION_TLSv1_3:
failf(data, "DarwinSSL: TLS 1.3 is not yet supported");
return CURLE_SSL_CONNECT_ERROR;
{
CURLcode result = set_ssl_version_min_max(conn, sockindex);
if(result != CURLE_OK)
return result;
} break;
case CURL_SSLVERSION_SSLv3:
err = SSLSetProtocolVersionEnabled(connssl->ssl_ctx,
kSSLProtocol3,
Expand All @@ -1207,6 +1287,11 @@ static CURLcode darwinssl_connect_step1(struct connectdata *conn,
#endif /* CURL_SUPPORT_MAC_10_8 */
}
#else
if(conn->ssl_config.version_max != CURL_SSLVERSION_MAX_NONE) {
failf(data, "Your version of the OS does not support to set maximum"
" SSL/TLS version");
return CURLE_SSL_CONNECT_ERROR;
}
(void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx, kSSLProtocolAll, false);
switch(conn->ssl_config.version) {
case CURL_SSLVERSION_DEFAULT:
Expand Down