romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-24 17:37:18 +03:00
Code Issues Projects Releases Packages Wiki Activity

TLS: remove support for Secure Transport and BearSSL

Browse source 
These libraries do not support TLS 1.3 and have been marked for removal
for over a year. We want to help users select a TLS dependency that is
future-proof and reliable, and not supporting TLS 1.3 in 2025 does not
infer confidence. Users who build libcurl are likely to be served better
and get something more future-proof with a TLS library that supports
1.3.

Closes #16677
This commit is contained in:
Daniel Stenberg 2025-06-09 14:07:21 +02:00
parent b761eb5add
commit 08a3e8e19a
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
89 changed files with 163 additions and 5036 deletions
Download patch file Download diff file Expand all files Collapse all files

2
lib/CMakeLists.txt
View file

@ -255,8 +255,6 @@ if(BUILD_SHARED_LIBS)
set(CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX "OPENSSL_")
elseif(CURL_USE_MBEDTLS)
set(CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX "MBEDTLS_")
elseif(CURL_USE_BEARSSL)
set(CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX "BEARSSL_")
elseif(CURL_USE_WOLFSSL)
set(CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX "WOLFSSL_")
elseif(CURL_USE_GNUTLS)

4
lib/Makefile.inc
View file

@ -71,7 +71,6 @@ LIB_VAUTH_HFILES = \
vauth/vauth.h
LIB_VTLS_CFILES = \
vtls/bearssl.c \
vtls/cipher_suite.c \
vtls/gtls.c \
vtls/hostcheck.c \
@ -82,7 +81,6 @@ LIB_VTLS_CFILES = \
vtls/rustls.c \
vtls/schannel.c \
vtls/schannel_verify.c \
vtls/sectransp.c \
vtls/vtls.c \
vtls/vtls_scache.c \
vtls/vtls_spack.c \
@ -90,7 +88,6 @@ LIB_VTLS_CFILES = \
vtls/x509asn1.c
LIB_VTLS_HFILES = \
vtls/bearssl.h \
vtls/cipher_suite.h \
vtls/gtls.h \
vtls/hostcheck.h \
@ -101,7 +98,6 @@ LIB_VTLS_HFILES = \
vtls/rustls.h \
vtls/schannel.h \
vtls/schannel_int.h \
vtls/sectransp.h \
vtls/vtls.h \
vtls/vtls_int.h \
vtls/vtls_scache.h \

6
lib/curl_config.h.cmake
View file

@ -685,18 +685,12 @@ ${SIZEOF_TIME_T_CODE}
/* if GnuTLS is enabled */
#cmakedefine USE_GNUTLS 1
/* if Secure Transport is enabled */
#cmakedefine USE_SECTRANSP 1
/* if SSL session export support is available */
#cmakedefine USE_SSLS_EXPORT 1
/* if mbedTLS is enabled */
#cmakedefine USE_MBEDTLS 1
/* if BearSSL is enabled */
#cmakedefine USE_BEARSSL 1
/* if Rustls is enabled */
#cmakedefine USE_RUSTLS 1

1
lib/curl_des.c
View file

@ -26,7 +26,6 @@
#if defined(USE_CURL_NTLM_CORE) && \
(defined(USE_GNUTLS) || \
defined(USE_SECTRANSP) || \
defined(USE_OS400CRYPTO) || \
defined(USE_WIN32_CRYPTO))

1
lib/curl_des.h
View file

@ -28,7 +28,6 @@
#if defined(USE_CURL_NTLM_CORE) && \
(defined(USE_GNUTLS) || \
defined(USE_SECTRANSP) || \
defined(USE_OS400CRYPTO) || \
defined(USE_WIN32_CRYPTO))

41
lib/curl_ntlm_core.c
View file

@ -40,9 +40,8 @@
3. USE_GNUTLS
4. -
5. USE_MBEDTLS
6. USE_SECTRANSP
7. USE_OS400CRYPTO
8. USE_WIN32_CRYPTO
6. USE_OS400CRYPTO
7. USE_WIN32_CRYPTO
This ensures that:
- the same SSL branch gets activated throughout this source
@ -107,11 +106,6 @@
# include <mbedtls/des.h>
#elif defined(USE_SECTRANSP)
# include <CommonCrypto/CommonCryptor.h>
# include <CommonCrypto/CommonDigest.h>
#elif defined(USE_OS400CRYPTO)
# include "cipher.mih" /* mih/cipher */
#elif defined(USE_WIN32_CRYPTO)
@ -209,29 +203,6 @@ static bool encrypt_des(const unsigned char *in, unsigned char *out,
return mbedtls_des_crypt_ecb(&ctx, in, out) == 0;
}
#elif defined(USE_SECTRANSP)
static bool encrypt_des(const unsigned char *in, unsigned char *out,
const unsigned char *key_56)
{
char key[8];
size_t out_len;
CCCryptorStatus err;
/* Expand the 56-bit key to 64 bits */
extend_key_56_to_64(key_56, key);
/* Set the key parity to odd */
Curl_des_set_odd_parity((unsigned char *) key, sizeof(key));
/* Perform the encryption */
err = CCCrypt(kCCEncrypt, kCCAlgorithmDES, kCCOptionECBMode, key,
kCCKeySizeDES, NULL, in, 8 /* inbuflen */, out,
8 /* outbuflen */, &out_len);
return err == kCCSuccess;
}
#elif defined(USE_OS400CRYPTO)
static bool encrypt_des(const unsigned char *in, unsigned char *out,
@ -339,8 +310,8 @@ void Curl_ntlm_core_lm_resp(const unsigned char *keys,
des_encrypt(&des, 8, results + 8, plaintext);
setup_des_key(keys + 14, &des);
des_encrypt(&des, 8, results + 16, plaintext);
#elif defined(USE_MBEDTLS) || defined(USE_SECTRANSP) \
|| defined(USE_OS400CRYPTO) || defined(USE_WIN32_CRYPTO)
#elif defined(USE_MBEDTLS) || defined(USE_OS400CRYPTO) || \
defined(USE_WIN32_CRYPTO)
encrypt_des(plaintext, results, keys);
encrypt_des(plaintext, results + 8, keys + 7);
encrypt_des(plaintext, results + 16, keys + 14);
@ -387,8 +358,8 @@ CURLcode Curl_ntlm_core_mk_lm_hash(const char *password,
des_encrypt(&des, 8, lmbuffer, magic);
setup_des_key(pw + 7, &des);
des_encrypt(&des, 8, lmbuffer + 8, magic);
#elif defined(USE_MBEDTLS) || defined(USE_SECTRANSP) \
|| defined(USE_OS400CRYPTO) || defined(USE_WIN32_CRYPTO)
#elif defined(USE_MBEDTLS) || defined(USE_OS400CRYPTO) || \
defined(USE_WIN32_CRYPTO)
encrypt_des(magic, lmbuffer, pw);
encrypt_des(magic, lmbuffer + 8, pw + 7);
#endif

6
lib/curl_setup.h
View file

@ -739,8 +739,8 @@
#endif
#if defined(USE_GNUTLS) || defined(USE_OPENSSL) || defined(USE_MBEDTLS) || \
defined(USE_WOLFSSL) || defined(USE_SCHANNEL) || defined(USE_SECTRANSP) || \
defined(USE_BEARSSL) || defined(USE_RUSTLS)
defined(USE_WOLFSSL) || defined(USE_SCHANNEL) || \
defined(USE_RUSTLS)
#define USE_SSL /* SSL support has been enabled */
#endif
@ -775,7 +775,7 @@
/* Single point where USE_NTLM definition might be defined */
#ifndef CURL_DISABLE_NTLM
# if defined(USE_OPENSSL) || defined(USE_MBEDTLS) || \
defined(USE_GNUTLS) || defined(USE_SECTRANSP) || \
defined(USE_GNUTLS) || \
defined(USE_OS400CRYPTO) || defined(USE_WIN32_CRYPTO) || \
(defined(USE_WOLFSSL) && defined(HAVE_WOLFSSL_DES_ECB_ENCRYPT))
# define USE_CURL_NTLM_CORE

2
lib/curl_sha512_256.c
View file

@ -34,9 +34,7 @@
* * GnuTLS
* * wolfSSL
* * Schannel SSPI
* * Secure Transport (Darwin)
* * mbedTLS
* * BearSSL
* * Rustls
* Skip the backend if it does not support the required algorithm */

10
lib/url.c
View file

@ -425,13 +425,11 @@ CURLcode Curl_init_userdefined(struct Curl_easy *data)
/* Set the default CA cert bundle/path detected/specified at build time.
*
* If Schannel or Secure Transport is the selected SSL backend then these
* locations are ignored. We allow setting CA location for Schannel and
* Secure Transport when explicitly specified by the user via
* CURLOPT_CAINFO / --cacert.
* If Schannel is the selected SSL backend then these locations are ignored.
* We allow setting CA location for Schannel when explicitly specified by
* the user via CURLOPT_CAINFO / --cacert.
*/
if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL &&
Curl_ssl_backend() != CURLSSLBACKEND_SECURETRANSPORT) {
if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) {
#ifdef CURL_CA_BUNDLE
result = Curl_setstropt(&set->str[STRING_SSL_CAFILE], CURL_CA_BUNDLE);
if(result)

1104
lib/vtls/bearssl.c
View file

File diff suppressed because it is too large Load diff

34
lib/vtls/bearssl.h
View file

@ -1,34 +0,0 @@
#ifndef HEADER_CURL_BEARSSL_H
#define HEADER_CURL_BEARSSL_H
/***************************************************************************
* _ _ ____ _
* Project ___| | | | _ \| |
* / __| | | | |_) | |
* | (__| |_| | _ <| |___
* \___|\___/|_| \_\_____|
*
* Copyright (C) Michael Forney, <mforney@mforney.org>
*
* This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms
* are also available at https://curl.se/docs/copyright.html.
*
* You may opt to use, copy, modify, merge, publish, distribute and/or sell
* copies of the Software, and permit persons to whom the Software is
* furnished to do so, under the terms of the COPYING file.
*
* This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
* KIND, either express or implied.
*
* SPDX-License-Identifier: curl
*
***************************************************************************/
#include "../curl_setup.h"
#ifdef USE_BEARSSL
extern const struct Curl_ssl Curl_ssl_bearssl;
#endif /* USE_BEARSSL */
#endif /* HEADER_CURL_BEARSSL_H */

191
lib/vtls/cipher_suite.c
View file

@ -23,8 +23,7 @@
***************************************************************************/
#include "../curl_setup.h"
#if defined(USE_SECTRANSP) || defined(USE_MBEDTLS) || \
defined(USE_BEARSSL) || defined(USE_RUSTLS)
#if defined(USE_MBEDTLS) || defined(USE_RUSTLS)
#include "cipher_suite.h"
#include "../curl_printf.h"
#include "../strcase.h"
@ -90,21 +89,6 @@ static const char *cs_txt =
"CAMELLIA128" "\0"
"CAMELLIA256" "\0"
#endif
#if defined(USE_SECTRANSP)
"40" "\0"
"ADH" "\0"
"AECDH" "\0"
"anon" "\0"
"DES40" "\0"
"DH" "\0"
"DSS" "\0"
"EDH" "\0"
"EXP" "\0"
"EXPORT" "\0"
"IDEA" "\0"
"RC2" "\0"
"RC4" "\0"
#endif
;
/* Indexes of above cs_txt */
enum {
@ -145,21 +129,6 @@ enum {
CS_TXT_IDX_CAMELLIA,
CS_TXT_IDX_CAMELLIA128,
CS_TXT_IDX_CAMELLIA256,
#endif
#if defined(USE_SECTRANSP)
CS_TXT_IDX_40,
CS_TXT_IDX_ADH,
CS_TXT_IDX_AECDH,
CS_TXT_IDX_anon,
CS_TXT_IDX_DES40,
CS_TXT_IDX_DH,
CS_TXT_IDX_DSS,
CS_TXT_IDX_EDH,
CS_TXT_IDX_EXP,
CS_TXT_IDX_EXPORT,
CS_TXT_IDX_IDEA,
CS_TXT_IDX_RC2,
CS_TXT_IDX_RC4,
#endif
CS_TXT_LEN,
};
@ -192,7 +161,7 @@ struct cs_entry {
/* !checksrc! disable COMMANOSPACE all */
static const struct cs_entry cs_list [] = {
/* TLS 1.3 ciphers */
#if defined(USE_SECTRANSP) || defined(USE_MBEDTLS) || defined(USE_RUSTLS)
#if defined(USE_MBEDTLS) || defined(USE_RUSTLS)
CS_ENTRY(0x1301, TLS,AES,128,GCM,SHA256,,,),
CS_ENTRY(0x1302, TLS,AES,256,GCM,SHA384,,,),
CS_ENTRY(0x1303, TLS,CHACHA20,POLY1305,SHA256,,,,),
@ -212,7 +181,7 @@ static const struct cs_entry cs_list [] = {
CS_ENTRY(0xCCA8, ECDHE,RSA,CHACHA20,POLY1305,,,,),
CS_ENTRY(0xCCA9, TLS,ECDHE,ECDSA,WITH,CHACHA20,POLY1305,SHA256,),
CS_ENTRY(0xCCA9, ECDHE,ECDSA,CHACHA20,POLY1305,,,,),
#if defined(USE_SECTRANSP) || defined(USE_MBEDTLS) || defined(USE_BEARSSL)
#if defined(USE_MBEDTLS)
CS_ENTRY(0x002F, TLS,RSA,WITH,AES,128,CBC,SHA,),
CS_ENTRY(0x002F, AES128,SHA,,,,,,),
CS_ENTRY(0x0035, TLS,RSA,WITH,AES,256,CBC,SHA,),
@ -266,7 +235,7 @@ static const struct cs_entry cs_list [] = {
CS_ENTRY(0xC032, TLS,ECDH,RSA,WITH,AES,256,GCM,SHA384),
CS_ENTRY(0xC032, ECDH,RSA,AES256,GCM,SHA384,,,),
#endif
#if defined(USE_SECTRANSP) || defined(USE_MBEDTLS)
#if defined(USE_MBEDTLS)
CS_ENTRY(0x0001, TLS,RSA,WITH,NULL,MD5,,,),
CS_ENTRY(0x0001, NULL,MD5,,,,,,),
CS_ENTRY(0x0002, TLS,RSA,WITH,NULL,SHA,,,),
@ -354,19 +323,7 @@ static const struct cs_entry cs_list [] = {
CS_ENTRY(0xCCAB, TLS,PSK,WITH,CHACHA20,POLY1305,SHA256,,),
CS_ENTRY(0xCCAB, PSK,CHACHA20,POLY1305,,,,,),
#endif
#if defined(USE_SECTRANSP) || defined(USE_BEARSSL)
CS_ENTRY(0x000A, TLS,RSA,WITH,3DES,EDE,CBC,SHA,),
CS_ENTRY(0x000A, DES,CBC3,SHA,,,,,),
CS_ENTRY(0xC003, TLS,ECDH,ECDSA,WITH,3DES,EDE,CBC,SHA),
CS_ENTRY(0xC003, ECDH,ECDSA,DES,CBC3,SHA,,,),
CS_ENTRY(0xC008, TLS,ECDHE,ECDSA,WITH,3DES,EDE,CBC,SHA),
CS_ENTRY(0xC008, ECDHE,ECDSA,DES,CBC3,SHA,,,),
CS_ENTRY(0xC00D, TLS,ECDH,RSA,WITH,3DES,EDE,CBC,SHA),
CS_ENTRY(0xC00D, ECDH,RSA,DES,CBC3,SHA,,,),
CS_ENTRY(0xC012, TLS,ECDHE,RSA,WITH,3DES,EDE,CBC,SHA),
CS_ENTRY(0xC012, ECDHE,RSA,DES,CBC3,SHA,,,),
#endif
#if defined(USE_MBEDTLS) || defined(USE_BEARSSL)
#if defined(USE_MBEDTLS)
CS_ENTRY(0xC09C, TLS,RSA,WITH,AES,128,CCM,,),
CS_ENTRY(0xC09C, AES128,CCM,,,,,,),
CS_ENTRY(0xC09D, TLS,RSA,WITH,AES,256,CCM,,),
@ -384,141 +341,6 @@ static const struct cs_entry cs_list [] = {
CS_ENTRY(0xC0AF, TLS,ECDHE,ECDSA,WITH,AES,256,CCM,8),
CS_ENTRY(0xC0AF, ECDHE,ECDSA,AES256,CCM8,,,,),
#endif
#if defined(USE_SECTRANSP)
/* entries marked bc are backward compatible aliases for old OpenSSL names */
CS_ENTRY(0x0003, TLS,RSA,EXPORT,WITH,RC4,40,MD5,),
CS_ENTRY(0x0003, EXP,RC4,MD5,,,,,),
CS_ENTRY(0x0004, TLS,RSA,WITH,RC4,128,MD5,,),
CS_ENTRY(0x0004, RC4,MD5,,,,,,),
CS_ENTRY(0x0005, TLS,RSA,WITH,RC4,128,SHA,,),
CS_ENTRY(0x0005, RC4,SHA,,,,,,),
CS_ENTRY(0x0006, TLS,RSA,EXPORT,WITH,RC2,CBC,40,MD5),
CS_ENTRY(0x0006, EXP,RC2,CBC,MD5,,,,),
CS_ENTRY(0x0007, TLS,RSA,WITH,IDEA,CBC,SHA,,),
CS_ENTRY(0x0007, IDEA,CBC,SHA,,,,,),
CS_ENTRY(0x0008, TLS,RSA,EXPORT,WITH,DES40,CBC,SHA,),
CS_ENTRY(0x0008, EXP,DES,CBC,SHA,,,,),
CS_ENTRY(0x0009, TLS,RSA,WITH,DES,CBC,SHA,,),
CS_ENTRY(0x0009, DES,CBC,SHA,,,,,),
CS_ENTRY(0x000B, TLS,DH,DSS,EXPORT,WITH,DES40,CBC,SHA),
CS_ENTRY(0x000B, EXP,DH,DSS,DES,CBC,SHA,,),
CS_ENTRY(0x000C, TLS,DH,DSS,WITH,DES,CBC,SHA,),
CS_ENTRY(0x000C, DH,DSS,DES,CBC,SHA,,,),
CS_ENTRY(0x000D, TLS,DH,DSS,WITH,3DES,EDE,CBC,SHA),
CS_ENTRY(0x000D, DH,DSS,DES,CBC3,SHA,,,),
CS_ENTRY(0x000E, TLS,DH,RSA,EXPORT,WITH,DES40,CBC,SHA),
CS_ENTRY(0x000E, EXP,DH,RSA,DES,CBC,SHA,,),
CS_ENTRY(0x000F, TLS,DH,RSA,WITH,DES,CBC,SHA,),
CS_ENTRY(0x000F, DH,RSA,DES,CBC,SHA,,,),
CS_ENTRY(0x0010, TLS,DH,RSA,WITH,3DES,EDE,CBC,SHA),
CS_ENTRY(0x0010, DH,RSA,DES,CBC3,SHA,,,),
CS_ENTRY(0x0011, TLS,DHE,DSS,EXPORT,WITH,DES40,CBC,SHA),
CS_ENTRY(0x0011, EXP,DHE,DSS,DES,CBC,SHA,,),
CS_ENTRY(0x0011, EXP,EDH,DSS,DES,CBC,SHA,,), /* bc */
CS_ENTRY(0x0012, TLS,DHE,DSS,WITH,DES,CBC,SHA,),
CS_ENTRY(0x0012, DHE,DSS,DES,CBC,SHA,,,),
CS_ENTRY(0x0012, EDH,DSS,DES,CBC,SHA,,,), /* bc */
CS_ENTRY(0x0013, TLS,DHE,DSS,WITH,3DES,EDE,CBC,SHA),
CS_ENTRY(0x0013, DHE,DSS,DES,CBC3,SHA,,,),
CS_ENTRY(0x0013, EDH,DSS,DES,CBC3,SHA,,,), /* bc */
CS_ENTRY(0x0014, TLS,DHE,RSA,EXPORT,WITH,DES40,CBC,SHA),
CS_ENTRY(0x0014, EXP,DHE,RSA,DES,CBC,SHA,,),
CS_ENTRY(0x0014, EXP,EDH,RSA,DES,CBC,SHA,,), /* bc */
CS_ENTRY(0x0015, TLS,DHE,RSA,WITH,DES,CBC,SHA,),
CS_ENTRY(0x0015, DHE,RSA,DES,CBC,SHA,,,),
CS_ENTRY(0x0015, EDH,RSA,DES,CBC,SHA,,,), /* bc */
CS_ENTRY(0x0016, TLS,DHE,RSA,WITH,3DES,EDE,CBC,SHA),
CS_ENTRY(0x0016, DHE,RSA,DES,CBC3,SHA,,,),
CS_ENTRY(0x0016, EDH,RSA,DES,CBC3,SHA,,,), /* bc */
CS_ENTRY(0x0017, TLS,DH,anon,EXPORT,WITH,RC4,40,MD5),
CS_ENTRY(0x0017, EXP,ADH,RC4,MD5,,,,),
CS_ENTRY(0x0018, TLS,DH,anon,WITH,RC4,128,MD5,),
CS_ENTRY(0x0018, ADH,RC4,MD5,,,,,),
CS_ENTRY(0x0019, TLS,DH,anon,EXPORT,WITH,DES40,CBC,SHA),
CS_ENTRY(0x0019, EXP,ADH,DES,CBC,SHA,,,),
CS_ENTRY(0x001A, TLS,DH,anon,WITH,DES,CBC,SHA,),
CS_ENTRY(0x001A, ADH,DES,CBC,SHA,,,,),
CS_ENTRY(0x001B, TLS,DH,anon,WITH,3DES,EDE,CBC,SHA),
CS_ENTRY(0x001B, ADH,DES,CBC3,SHA,,,,),
CS_ENTRY(0x0030, TLS,DH,DSS,WITH,AES,128,CBC,SHA),
CS_ENTRY(0x0030, DH,DSS,AES128,SHA,,,,),
CS_ENTRY(0x0031, TLS,DH,RSA,WITH,AES,128,CBC,SHA),
CS_ENTRY(0x0031, DH,RSA,AES128,SHA,,,,),
CS_ENTRY(0x0032, TLS,DHE,DSS,WITH,AES,128,CBC,SHA),
CS_ENTRY(0x0032, DHE,DSS,AES128,SHA,,,,),
CS_ENTRY(0x0034, TLS,DH,anon,WITH,AES,128,CBC,SHA),
CS_ENTRY(0x0034, ADH,AES128,SHA,,,,,),
CS_ENTRY(0x0036, TLS,DH,DSS,WITH,AES,256,CBC,SHA),
CS_ENTRY(0x0036, DH,DSS,AES256,SHA,,,,),
CS_ENTRY(0x0037, TLS,DH,RSA,WITH,AES,256,CBC,SHA),
CS_ENTRY(0x0037, DH,RSA,AES256,SHA,,,,),
CS_ENTRY(0x0038, TLS,DHE,DSS,WITH,AES,256,CBC,SHA),
CS_ENTRY(0x0038, DHE,DSS,AES256,SHA,,,,),
CS_ENTRY(0x003A, TLS,DH,anon,WITH,AES,256,CBC,SHA),
CS_ENTRY(0x003A, ADH,AES256,SHA,,,,,),
CS_ENTRY(0x003E, TLS,DH,DSS,WITH,AES,128,CBC,SHA256),
CS_ENTRY(0x003E, DH,DSS,AES128,SHA256,,,,),
CS_ENTRY(0x003F, TLS,DH,RSA,WITH,AES,128,CBC,SHA256),
CS_ENTRY(0x003F, DH,RSA,AES128,SHA256,,,,),
CS_ENTRY(0x0040, TLS,DHE,DSS,WITH,AES,128,CBC,SHA256),
CS_ENTRY(0x0040, DHE,DSS,AES128,SHA256,,,,),
CS_ENTRY(0x0068, TLS,DH,DSS,WITH,AES,256,CBC,SHA256),
CS_ENTRY(0x0068, DH,DSS,AES256,SHA256,,,,),
CS_ENTRY(0x0069, TLS,DH,RSA,WITH,AES,256,CBC,SHA256),
CS_ENTRY(0x0069, DH,RSA,AES256,SHA256,,,,),
CS_ENTRY(0x006A, TLS,DHE,DSS,WITH,AES,256,CBC,SHA256),
CS_ENTRY(0x006A, DHE,DSS,AES256,SHA256,,,,),
CS_ENTRY(0x006C, TLS,DH,anon,WITH,AES,128,CBC,SHA256),
CS_ENTRY(0x006C, ADH,AES128,SHA256,,,,,),
CS_ENTRY(0x006D, TLS,DH,anon,WITH,AES,256,CBC,SHA256),
CS_ENTRY(0x006D, ADH,AES256,SHA256,,,,,),
CS_ENTRY(0x008A, TLS,PSK,WITH,RC4,128,SHA,,),
CS_ENTRY(0x008A, PSK,RC4,SHA,,,,,),
CS_ENTRY(0x008B, TLS,PSK,WITH,3DES,EDE,CBC,SHA,),
CS_ENTRY(0x008B, PSK,3DES,EDE,CBC,SHA,,,),
CS_ENTRY(0x008E, TLS,DHE,PSK,WITH,RC4,128,SHA,),
CS_ENTRY(0x008E, DHE,PSK,RC4,SHA,,,,),
CS_ENTRY(0x008F, TLS,DHE,PSK,WITH,3DES,EDE,CBC,SHA),
CS_ENTRY(0x008F, DHE,PSK,3DES,EDE,CBC,SHA,,),
CS_ENTRY(0x0092, TLS,RSA,PSK,WITH,RC4,128,SHA,),
CS_ENTRY(0x0092, RSA,PSK,RC4,SHA,,,,),
CS_ENTRY(0x0093, TLS,RSA,PSK,WITH,3DES,EDE,CBC,SHA),
CS_ENTRY(0x0093, RSA,PSK,3DES,EDE,CBC,SHA,,),
CS_ENTRY(0x00A0, TLS,DH,RSA,WITH,AES,128,GCM,SHA256),
CS_ENTRY(0x00A0, DH,RSA,AES128,GCM,SHA256,,,),
CS_ENTRY(0x00A1, TLS,DH,RSA,WITH,AES,256,GCM,SHA384),
CS_ENTRY(0x00A1, DH,RSA,AES256,GCM,SHA384,,,),
CS_ENTRY(0x00A2, TLS,DHE,DSS,WITH,AES,128,GCM,SHA256),
CS_ENTRY(0x00A2, DHE,DSS,AES128,GCM,SHA256,,,),
CS_ENTRY(0x00A3, TLS,DHE,DSS,WITH,AES,256,GCM,SHA384),
CS_ENTRY(0x00A3, DHE,DSS,AES256,GCM,SHA384,,,),
CS_ENTRY(0x00A4, TLS,DH,DSS,WITH,AES,128,GCM,SHA256),
CS_ENTRY(0x00A4, DH,DSS,AES128,GCM,SHA256,,,),
CS_ENTRY(0x00A5, TLS,DH,DSS,WITH,AES,256,GCM,SHA384),
CS_ENTRY(0x00A5, DH,DSS,AES256,GCM,SHA384,,,),
CS_ENTRY(0x00A6, TLS,DH,anon,WITH,AES,128,GCM,SHA256),
CS_ENTRY(0x00A6, ADH,AES128,GCM,SHA256,,,,),
CS_ENTRY(0x00A7, TLS,DH,anon,WITH,AES,256,GCM,SHA384),
CS_ENTRY(0x00A7, ADH,AES256,GCM,SHA384,,,,),
CS_ENTRY(0xC002, TLS,ECDH,ECDSA,WITH,RC4,128,SHA,),
CS_ENTRY(0xC002, ECDH,ECDSA,RC4,SHA,,,,),
CS_ENTRY(0xC007, TLS,ECDHE,ECDSA,WITH,RC4,128,SHA,),
CS_ENTRY(0xC007, ECDHE,ECDSA,RC4,SHA,,,,),
CS_ENTRY(0xC00C, TLS,ECDH,RSA,WITH,RC4,128,SHA,),
CS_ENTRY(0xC00C, ECDH,RSA,RC4,SHA,,,,),
CS_ENTRY(0xC011, TLS,ECDHE,RSA,WITH,RC4,128,SHA,),
CS_ENTRY(0xC011, ECDHE,RSA,RC4,SHA,,,,),
CS_ENTRY(0xC015, TLS,ECDH,anon,WITH,NULL,SHA,,),
CS_ENTRY(0xC015, AECDH,NULL,SHA,,,,,),
CS_ENTRY(0xC016, TLS,ECDH,anon,WITH,RC4,128,SHA,),
CS_ENTRY(0xC016, AECDH,RC4,SHA,,,,,),
CS_ENTRY(0xC017, TLS,ECDH,anon,WITH,3DES,EDE,CBC,SHA),
CS_ENTRY(0xC017, AECDH,DES,CBC3,SHA,,,,),
CS_ENTRY(0xC018, TLS,ECDH,anon,WITH,AES,128,CBC,SHA),
CS_ENTRY(0xC018, AECDH,AES128,SHA,,,,,),
CS_ENTRY(0xC019, TLS,ECDH,anon,WITH,AES,256,CBC,SHA),
CS_ENTRY(0xC019, AECDH,AES256,SHA,,,,,),
#endif
#if defined(USE_MBEDTLS)
/* entries marked ns are "non-standard", they are not in OpenSSL */
CS_ENTRY(0x0041, TLS,RSA,WITH,CAMELLIA,128,CBC,SHA,),
@ -887,5 +709,4 @@ int Curl_cipher_suite_get_str(uint16_t id, char *buf, size_t buf_size,
return r;
}
#endif /* defined(USE_SECTRANSP) || defined(USE_MBEDTLS) || \
defined(USE_BEARSSL) || defined(USE_RUSTLS) */
#endif /* defined(USE_MBEDTLS) || defined(USE_RUSTLS) */

6
lib/vtls/cipher_suite.h
View file

@ -26,8 +26,7 @@
#include "../curl_setup.h"
#if defined(USE_SECTRANSP) || defined(USE_MBEDTLS) || \
defined(USE_BEARSSL) || defined(USE_RUSTLS)
#if defined(USE_MBEDTLS) || defined(USE_RUSTLS)
#include <stdint.h>
/* Lookup IANA id for cipher suite string, returns 0 if not recognized */
@ -43,6 +42,5 @@ uint16_t Curl_cipher_suite_walk_str(const char **str, const char **end);
int Curl_cipher_suite_get_str(uint16_t id, char *buf, size_t buf_size,
bool prefer_rfc);
#endif /* defined(USE_SECTRANSP) || defined(USE_MBEDTLS) || \
defined(USE_BEARSSL) || defined(USE_RUSTLS) */
#endif /* defined(USE_MBEDTLS) || defined(USE_RUSTLS) */
#endif /* HEADER_CURL_CIPHER_SUITE_H */

2708
lib/vtls/sectransp.c
View file

File diff suppressed because it is too large Load diff

34
lib/vtls/sectransp.h
View file

@ -1,34 +0,0 @@
#ifndef HEADER_CURL_SECTRANSP_H
#define HEADER_CURL_SECTRANSP_H
/***************************************************************************
* _ _ ____ _
* Project ___| | | | _ \| |
* / __| | | | |_) | |
* | (__| |_| | _ <| |___
* \___|\___/|_| \_\_____|
*
* Copyright (C) Nick Zitzmann, <nickzman@gmail.com>.
* Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
*
* This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms
* are also available at https://curl.se/docs/copyright.html.
*
* You may opt to use, copy, modify, merge, publish, distribute and/or sell
* copies of the Software, and permit persons to whom the Software is
* furnished to do so, under the terms of the COPYING file.
*
* This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
* KIND, either express or implied.
*
* SPDX-License-Identifier: curl
*
***************************************************************************/
#include "../curl_setup.h"
#ifdef USE_SECTRANSP
extern const struct Curl_ssl Curl_ssl_sectransp;
#endif /* USE_SECTRANSP */
#endif /* HEADER_CURL_SECTRANSP_H */

12
lib/vtls/vtls.c
View file

@ -61,9 +61,7 @@
#include "gtls.h" /* GnuTLS versions */
#include "wolfssl.h" /* wolfSSL versions */
#include "schannel.h" /* Schannel SSPI version */
#include "sectransp.h" /* Secure Transport (Darwin) version */
#include "mbedtls.h" /* mbedTLS versions */
#include "bearssl.h" /* BearSSL versions */
#include "rustls.h" /* Rustls versions */
#include "../slist.h"
@ -988,12 +986,8 @@ const struct Curl_ssl *Curl_ssl =
&Curl_ssl_rustls;
#elif defined(USE_OPENSSL)
&Curl_ssl_openssl;
#elif defined(USE_SECTRANSP)
&Curl_ssl_sectransp;
#elif defined(USE_SCHANNEL)
&Curl_ssl_schannel;
#elif defined(USE_BEARSSL)
&Curl_ssl_bearssl;
#else
#error "Missing struct Curl_ssl for selected SSL backend"
#endif
@ -1011,15 +1005,9 @@ static const struct Curl_ssl *available_backends[] = {
#if defined(USE_OPENSSL)
&Curl_ssl_openssl,
#endif
#if defined(USE_SECTRANSP)
&Curl_ssl_sectransp,
#endif
#if defined(USE_SCHANNEL)
&Curl_ssl_schannel,
#endif
#if defined(USE_BEARSSL)
&Curl_ssl_bearssl,
#endif
#if defined(USE_RUSTLS)
&Curl_ssl_rustls,
#endif

15
lib/vtls/x509asn1.c
View file

@ -24,17 +24,16 @@
#include "../curl_setup.h"
#if defined(USE_GNUTLS) || defined(USE_WOLFSSL) || \
defined(USE_SCHANNEL) || defined(USE_SECTRANSP) || \
#if defined(USE_GNUTLS) || defined(USE_WOLFSSL) || defined(USE_SCHANNEL) || \
defined(USE_MBEDTLS) || defined(USE_RUSTLS)
#if defined(USE_GNUTLS) || defined(USE_SCHANNEL) || defined(USE_SECTRANSP) || \
defined(USE_MBEDTLS) || defined(USE_WOLFSSL) || defined(USE_RUSTLS)
#if defined(USE_GNUTLS) || defined(USE_SCHANNEL) || defined(USE_MBEDTLS) || \
defined(USE_WOLFSSL) || defined(USE_RUSTLS)
#define WANT_PARSEX509 /* uses Curl_parseX509() */
#endif
#if defined(USE_GNUTLS) || defined(USE_SCHANNEL) || defined(USE_SECTRANSP) || \
defined(USE_MBEDTLS) || defined(USE_RUSTLS)
#if defined(USE_GNUTLS) || defined(USE_SCHANNEL) || defined(USE_MBEDTLS) || \
defined(USE_RUSTLS)
#define WANT_EXTRACT_CERTINFO /* uses Curl_extract_certinfo() */
#endif
@ -1277,5 +1276,5 @@ done:
#endif /* WANT_EXTRACT_CERTINFO */
#endif /* USE_GNUTLS or USE_WOLFSSL or USE_SCHANNEL or USE_SECTRANSP
or USE_MBEDTLS or USE_RUSTLS */
#endif /* USE_GNUTLS or USE_WOLFSSL or USE_SCHANNEL or USE_MBEDTLS or
USE_RUSTLS */

11
lib/vtls/x509asn1.h
View file

@ -27,8 +27,7 @@
#include "../curl_setup.h"
#if defined(USE_GNUTLS) || defined(USE_WOLFSSL) || \
defined(USE_SCHANNEL) || defined(USE_SECTRANSP) || \
#if defined(USE_GNUTLS) || defined(USE_WOLFSSL) || defined(USE_SCHANNEL) || \
defined(USE_MBEDTLS) || defined(USE_RUSTLS)
#include "../cfilters.h"
@ -79,8 +78,8 @@ CURLcode Curl_verifyhost(struct Curl_cfilter *cf, struct Curl_easy *data,
const char *beg, const char *end);
#ifdef UNITTESTS
#if defined(USE_GNUTLS) || defined(USE_SCHANNEL) || defined(USE_SECTRANSP) || \
defined(USE_MBEDTLS) || defined(USE_RUSTLS)
#if defined(USE_GNUTLS) || defined(USE_SCHANNEL) || defined(USE_MBEDTLS) || \
defined(USE_RUSTLS)
/* used by unit1656.c */
CURLcode Curl_x509_GTime2str(struct dynbuf *store,
@ -91,6 +90,6 @@ CURLcode Curl_x509_getASN1Element(struct Curl_asn1Element *elem,
#endif
#endif
#endif /* USE_GNUTLS or USE_WOLFSSL or USE_SCHANNEL or USE_SECTRANSP
or USE_MBEDTLS or USE_RUSTLS */
#endif /* USE_GNUTLS or USE_WOLFSSL or USE_SCHANNEL or USE_MBEDTLS or
USE_RUSTLS */
#endif /* HEADER_CURL_X509ASN1_H */