Commit 6ad3add6 authored by Kamil Dudka's avatar Kamil Dudka
Browse files

vtls: support TLS 1.3 via CURL_SSLVERSION_TLSv1_3 

Fully implemented with the NSS backend only for now.

Reviewed-by: Ray Satiro
parent 5d45ced7

RELEASE-NOTES

+1 −0
Original line number Diff line number Diff line
@@ -9,6 +9,7 @@ Curl and libcurl 7.51.1 
This release includes the following changes:



 o nss: map CURL_SSLVERSION_DEFAULT to NSS default

 o vtls: support TLS 1.3 via CURL_SSLVERSION_TLSv1_3

 o



This release includes the following bugfixes:

docs/libcurl/opts/CURLOPT_SSLVERSION.3

+2 −0
Original line number Diff line number Diff line
@@ -48,6 +48,8 @@ TLSv1.0 (Added in 7.34.0) 
TLSv1.1 (Added in 7.34.0)

.IP CURL_SSLVERSION_TLSv1_2

TLSv1.2 (Added in 7.34.0)

.IP CURL_SSLVERSION_TLSv1_3

TLSv1.3 (Added in 7.51.1)

.RE

.SH DEFAULT

CURL_SSLVERSION_DEFAULT

docs/libcurl/symbols-in-versions

+1 −0
Original line number Diff line number Diff line
@@ -773,6 +773,7 @@ CURL_SSLVERSION_TLSv1 7.9.2 
CURL_SSLVERSION_TLSv1_0         7.34.0

CURL_SSLVERSION_TLSv1_1         7.34.0

CURL_SSLVERSION_TLSv1_2         7.34.0

CURL_SSLVERSION_TLSv1_3         7.51.1

CURL_TIMECOND_IFMODSINCE        7.9.7

CURL_TIMECOND_IFUNMODSINCE      7.9.7

CURL_TIMECOND_LASTMOD           7.9.7

include/curl/curl.h

+1 −0
Original line number Diff line number Diff line
@@ -1805,6 +1805,7 @@ enum { 
  CURL_SSLVERSION_TLSv1_0,

  CURL_SSLVERSION_TLSv1_1,

  CURL_SSLVERSION_TLSv1_2,

  CURL_SSLVERSION_TLSv1_3,



  CURL_SSLVERSION_LAST /* never use, keep last */

};

lib/vtls/darwinssl.c

+9 −0
Original line number Diff line number Diff line
@@ -1071,6 +1071,9 @@ static CURLcode darwinssl_connect_step1(struct connectdata *conn, 
        (void)SSLSetProtocolVersionMin(connssl->ssl_ctx, kTLSProtocol12);

        (void)SSLSetProtocolVersionMax(connssl->ssl_ctx, kTLSProtocol12);

        break;

      case CURL_SSLVERSION_TLSv1_3:

        failf(data, "TLSv1.3 is not yet supported with this TLS backend");

        return CURLE_SSL_CONNECT_ERROR;

      case CURL_SSLVERSION_SSLv3:

        err = SSLSetProtocolVersionMin(connssl->ssl_ctx, kSSLProtocol3);

        if(err != noErr) {
@@ -1122,6 +1125,9 @@ static CURLcode darwinssl_connect_step1(struct connectdata *conn, 
                                           kTLSProtocol12,

                                           true);

        break;

      case CURL_SSLVERSION_TLSv1_3:

        failf(data, "TLSv1.3 is not yet supported with this TLS backend");

        return CURLE_SSL_CONNECT_ERROR;

      case CURL_SSLVERSION_SSLv3:

        err = SSLSetProtocolVersionEnabled(connssl->ssl_ctx,

                                           kSSLProtocol3,
@@ -1160,6 +1166,9 @@ static CURLcode darwinssl_connect_step1(struct connectdata *conn, 
    case CURL_SSLVERSION_TLSv1_2:

      failf(data, "Your version of the OS does not support TLSv1.2");

      return CURLE_SSL_CONNECT_ERROR;

    case CURL_SSLVERSION_TLSv1_3:

      failf(data, "Your version of the OS does not support TLSv1.3");

      return CURLE_SSL_CONNECT_ERROR;

    case CURL_SSLVERSION_SSLv2:

      err = SSLSetProtocolVersionEnabled(connssl->ssl_ctx,

                                         kSSLProtocol2,