lib/vtls/sectransp.c: Specify cipher name for Mac Secure Transport back-end

[mkolechkin]

Add parser for CURLOPT_SSL_CIPHER_LIST option for Secure Transport (ST)
back-end. Similar to NNS and GSKit back-ends, new code parses string
value and configures ST library to use those ciphers for communication.

Create cipher spec data structure and initialize array of specs with
cipher number, names and flag. That array allows to add/modify ciphers
in one place instead of several functions in code. The flag is binary
value for backward compatibility with an existing wrapper
implementation. It can be extended later for other purposes like
support of specific TLS version.

Code change required some analysis of macOS SDK versions, we need to
know when one or another value of enum in macOS SDK was introduced,
and some other data. I created the TLS-CIPHERS.md file to summarize
that data I found and to add some more information about ciphers
could useful for others. That document is not completely ready yet
and I just want your opinion on it.

[bagder]

Isn't the cipher names and info better put in CIPHERS.md where we have the name info for other TLS backends?

[mkolechkin]

Isn't the cipher names and info better put in CIPHERS.md

Yes, I just want to finish the table first and then merge it to the existing file. It is more convenient for me right now. The new table has more information and I prefer to send it as a new file. If reviewers agree the information is useful and format is good enough, etc, I'll definitely merge it into the CIPHERS.md

Question. I did not work on wide tables in .MD format before. Looks it is not very nice to scroll it right/left on the github. Do you see better way to present that information? Maybe split it to several tables or use some HTML tables instead?
I'll read more about tables in MD files. Maybe I can reduce font size or something like that.

where we have the name info for other TLS backends?

I'll add references.

Thank you for review! :)

[nickzman]

Thank you for your contribution. I've got a few changes I'd like you to make.

[nickzman]

Good; the latest changes are no longer generating a failing grade when I try them on howsmyssl.com's analyzer API. I found some typos in the code.

[nickzman]

You're very close; you just have typos and a security flaw to cover now. Again, thanks for your work on this so far.

[mkolechkin]

I made several commits, probably I better summarize them here.

I updated PR based on comments, commit cc7f8f7 addresses most of them.
Then I thought a little bit and made changes: removed ssl_name and slightly modified error handling: fail on error instead of switch to default ciphers. Please take a look. If those changes are not reasonable, I can bring back ssl_name and default ciphers behavior on error. Commit b0fb321
The last commit cb84af2 was to fix iOS code guards. I looked at old SDKs (https://sskaje.me/ios-sdk-archive/) and found last cipher constants added to macOS SDK 10.15, they introduced to iOS SDK 13 (I have it on my machine and checked difference with v 11 available on the site I mentioned above). Also corrected iOS SDK guards for cipher constants as they were before my change

Please take a look.

[nickzman]

I made one more pass through this, and found one more typo in the comments. Otherwise, this is looking good.

[nickzman]

All right, this looks good. Can you squash this please? @bagder , do you want to review?

[mkolechkin]

All right, this looks good. Can you squash this please?

Thank you for your help!
I hope I squashed it right, did it the first time.

[mkolechkin]

@bagder @nickzman
Hi Daniel and Nick,
Do I need to do something more for this change to be merged into the master branch?
Thank you
Mike

[bagder]

I'm ready to merge once the feature window opens again. If all goes well, that's on Monday April 5th.

[bagder]

Thanks!

[mkolechkin]

Thank you, Daniel and Nick!