romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-05 22:06:15 +03:00
Code Issues Projects Releases Packages Wiki Activity

TLS: remove support for Secure Transport and BearSSL

Browse source 
These libraries do not support TLS 1.3 and have been marked for removal
for over a year. We want to help users select a TLS dependency that is
future-proof and reliable, and not supporting TLS 1.3 in 2025 does not
infer confidence. Users who build libcurl are likely to be served better
and get something more future-proof with a TLS library that supports
1.3.

Closes #16677
This commit is contained in:
Daniel Stenberg 2025-06-09 14:07:21 +02:00
parent b761eb5add
commit 08a3e8e19a
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
89 changed files with 163 additions and 5036 deletions
Download patch file Download diff file Expand all files Collapse all files

2
tests/unit/unit1651.c
View file

@ -34,7 +34,7 @@ static void unit_stop(void)
{
}
#if defined(USE_GNUTLS) || defined(USE_SCHANNEL) || defined(USE_SECTRANSP)
#if defined(USE_GNUTLS) || defined(USE_SCHANNEL)
/* cert captured from gdb when connecting to curl.se on October 26
2018 */

3
tests/unit/unit1656.c
View file

@ -35,8 +35,7 @@ static void unit_stop(void)
}
#if defined(USE_GNUTLS) || defined(USE_SCHANNEL) || defined(USE_SECTRANSP) || \
defined(USE_MBEDTLS)
#if defined(USE_GNUTLS) || defined(USE_SCHANNEL) || defined(USE_MBEDTLS)
struct test_spec {
const char *input;

184
tests/unit/unit3205.c
View file

@ -34,8 +34,7 @@ static void unit_stop(void)
{
}
#if defined(USE_SECTRANSP) || defined(USE_MBEDTLS) || \
defined(USE_BEARSSL) || defined(USE_RUSTLS)
#if defined(USE_MBEDTLS) || defined(USE_RUSTLS)
struct test_cs_entry {
uint16_t id;
@ -43,7 +42,7 @@ struct test_cs_entry {
const char *openssl;
};
static const struct test_cs_entry test_cs_list[] = {
#if defined(USE_SECTRANSP) || defined(USE_MBEDTLS) || defined(USE_RUSTLS)
#if defined(USE_MBEDTLS) || defined(USE_RUSTLS)
{ 0x1301, "TLS_AES_128_GCM_SHA256",
NULL },
{ 0x1302, "TLS_AES_256_GCM_SHA384",
@ -67,7 +66,7 @@ static const struct test_cs_entry test_cs_list[] = {
"ECDHE-RSA-CHACHA20-POLY1305" },
{ 0xCCA9, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
"ECDHE-ECDSA-CHACHA20-POLY1305" },
#if defined(USE_SECTRANSP) || defined(USE_MBEDTLS) || defined(USE_BEARSSL)
#if defined(USE_MBEDTLS)
{ 0x002F, "TLS_RSA_WITH_AES_128_CBC_SHA",
"AES128-SHA" },
{ 0x0035, "TLS_RSA_WITH_AES_256_CBC_SHA",
@ -121,7 +120,7 @@ static const struct test_cs_entry test_cs_list[] = {
{ 0xC032, "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384",
"ECDH-RSA-AES256-GCM-SHA384" },
#endif
#if defined(USE_SECTRANSP) || defined(USE_MBEDTLS)
#if defined(USE_MBEDTLS)
{ 0x0001, "TLS_RSA_WITH_NULL_MD5",
"NULL-MD5" },
{ 0x0002, "TLS_RSA_WITH_NULL_SHA",
@ -209,19 +208,7 @@ static const struct test_cs_entry test_cs_list[] = {
{ 0xCCAB, "TLS_PSK_WITH_CHACHA20_POLY1305_SHA256",
"PSK-CHACHA20-POLY1305" },
#endif
#if defined(USE_SECTRANSP) || defined(USE_BEARSSL)
{ 0x000A, "TLS_RSA_WITH_3DES_EDE_CBC_SHA",
"DES-CBC3-SHA" },
{ 0xC003, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA",
"ECDH-ECDSA-DES-CBC3-SHA" },
{ 0xC008, "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA",
"ECDHE-ECDSA-DES-CBC3-SHA" },
{ 0xC00D, "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA",
"ECDH-RSA-DES-CBC3-SHA" },
{ 0xC012, "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",
"ECDHE-RSA-DES-CBC3-SHA" },
#endif
#if defined(USE_MBEDTLS) || defined(USE_BEARSSL)
#if defined(USE_MBEDTLS)
{ 0xC09C, "TLS_RSA_WITH_AES_128_CCM",
"AES128-CCM" },
{ 0xC09D, "TLS_RSA_WITH_AES_256_CCM",
@ -239,147 +226,6 @@ static const struct test_cs_entry test_cs_list[] = {
{ 0xC0AF, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8",
"ECDHE-ECDSA-AES256-CCM8" },
#endif
#if defined(USE_SECTRANSP)
{ 0x0003, "TLS_RSA_EXPORT_WITH_RC4_40_MD5",
"EXP-RC4-MD5" },
{ 0x0004, "TLS_RSA_WITH_RC4_128_MD5",
"RC4-MD5" },
{ 0x0005, "TLS_RSA_WITH_RC4_128_SHA",
"RC4-SHA" },
{ 0x0006, "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5",
"EXP-RC2-CBC-MD5" },
{ 0x0007, "TLS_RSA_WITH_IDEA_CBC_SHA",
"IDEA-CBC-SHA" },
{ 0x0008, "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA",
"EXP-DES-CBC-SHA" },
{ 0x0009, "TLS_RSA_WITH_DES_CBC_SHA",
"DES-CBC-SHA" },
{ 0x000B, "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA",
"EXP-DH-DSS-DES-CBC-SHA" },
{ 0x000C, "TLS_DH_DSS_WITH_DES_CBC_SHA",
"DH-DSS-DES-CBC-SHA" },
{ 0x000D, "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA",
"DH-DSS-DES-CBC3-SHA" },
{ 0x000E, "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA",
"EXP-DH-RSA-DES-CBC-SHA" },
{ 0x000F, "TLS_DH_RSA_WITH_DES_CBC_SHA",
"DH-RSA-DES-CBC-SHA" },
{ 0x0010, "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA",
"DH-RSA-DES-CBC3-SHA" },
{ 0x0011, "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA",
"EXP-DHE-DSS-DES-CBC-SHA" },
{ 0x0012, "TLS_DHE_DSS_WITH_DES_CBC_SHA",
"DHE-DSS-DES-CBC-SHA" },
{ 0x0013, "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA",
"DHE-DSS-DES-CBC3-SHA" },
{ 0x0014, "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA",
"EXP-DHE-RSA-DES-CBC-SHA" },
{ 0x0015, "TLS_DHE_RSA_WITH_DES_CBC_SHA",
"DHE-RSA-DES-CBC-SHA" },
{ 0x0016, "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA",
"DHE-RSA-DES-CBC3-SHA" },
{ 0x0017, "TLS_DH_anon_EXPORT_WITH_RC4_40_MD5",
"EXP-ADH-RC4-MD5" },
{ 0x0018, "TLS_DH_anon_WITH_RC4_128_MD5",
"ADH-RC4-MD5" },
{ 0x0019, "TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA",
"EXP-ADH-DES-CBC-SHA" },
{ 0x001A, "TLS_DH_anon_WITH_DES_CBC_SHA",
"ADH-DES-CBC-SHA" },
{ 0x001B, "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA",
"ADH-DES-CBC3-SHA" },
{ 0x0030, "TLS_DH_DSS_WITH_AES_128_CBC_SHA",
"DH-DSS-AES128-SHA" },
{ 0x0031, "TLS_DH_RSA_WITH_AES_128_CBC_SHA",
"DH-RSA-AES128-SHA" },
{ 0x0032, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA",
"DHE-DSS-AES128-SHA" },
{ 0x0034, "TLS_DH_anon_WITH_AES_128_CBC_SHA",
"ADH-AES128-SHA" },
{ 0x0036, "TLS_DH_DSS_WITH_AES_256_CBC_SHA",
"DH-DSS-AES256-SHA" },
{ 0x0037, "TLS_DH_RSA_WITH_AES_256_CBC_SHA",
"DH-RSA-AES256-SHA" },
{ 0x0038, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA",
"DHE-DSS-AES256-SHA" },
{ 0x003A, "TLS_DH_anon_WITH_AES_256_CBC_SHA",
"ADH-AES256-SHA" },
{ 0x003E, "TLS_DH_DSS_WITH_AES_128_CBC_SHA256",
"DH-DSS-AES128-SHA256" },
{ 0x003F, "TLS_DH_RSA_WITH_AES_128_CBC_SHA256",
"DH-RSA-AES128-SHA256" },
{ 0x0040, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256",
"DHE-DSS-AES128-SHA256" },
{ 0x0068, "TLS_DH_DSS_WITH_AES_256_CBC_SHA256",
"DH-DSS-AES256-SHA256" },
{ 0x0069, "TLS_DH_RSA_WITH_AES_256_CBC_SHA256",
"DH-RSA-AES256-SHA256" },
{ 0x006A, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256",
"DHE-DSS-AES256-SHA256" },
{ 0x006C, "TLS_DH_anon_WITH_AES_128_CBC_SHA256",
"ADH-AES128-SHA256" },
{ 0x006D, "TLS_DH_anon_WITH_AES_256_CBC_SHA256",
"ADH-AES256-SHA256" },
{ 0x008A, "TLS_PSK_WITH_RC4_128_SHA",
"PSK-RC4-SHA" },
{ 0x008B, "TLS_PSK_WITH_3DES_EDE_CBC_SHA",
"PSK-3DES-EDE-CBC-SHA" },
{ 0x008E, "TLS_DHE_PSK_WITH_RC4_128_SHA",
"DHE-PSK-RC4-SHA" },
{ 0x008F, "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA",
"DHE-PSK-3DES-EDE-CBC-SHA" },
{ 0x0092, "TLS_RSA_PSK_WITH_RC4_128_SHA",
"RSA-PSK-RC4-SHA" },
{ 0x0093, "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA",
"RSA-PSK-3DES-EDE-CBC-SHA" },
{ 0x00A0, "TLS_DH_RSA_WITH_AES_128_GCM_SHA256",
"DH-RSA-AES128-GCM-SHA256" },
{ 0x00A1, "TLS_DH_RSA_WITH_AES_256_GCM_SHA384",
"DH-RSA-AES256-GCM-SHA384" },
{ 0x00A2, "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256",
"DHE-DSS-AES128-GCM-SHA256" },
{ 0x00A3, "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384",
"DHE-DSS-AES256-GCM-SHA384" },
{ 0x00A4, "TLS_DH_DSS_WITH_AES_128_GCM_SHA256",
"DH-DSS-AES128-GCM-SHA256" },
{ 0x00A5, "TLS_DH_DSS_WITH_AES_256_GCM_SHA384",
"DH-DSS-AES256-GCM-SHA384" },
{ 0x00A6, "TLS_DH_anon_WITH_AES_128_GCM_SHA256",
"ADH-AES128-GCM-SHA256" },
{ 0x00A7, "TLS_DH_anon_WITH_AES_256_GCM_SHA384",
"ADH-AES256-GCM-SHA384" },
{ 0xC002, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA",
"ECDH-ECDSA-RC4-SHA" },
{ 0xC007, "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA",
"ECDHE-ECDSA-RC4-SHA" },
{ 0xC00C, "TLS_ECDH_RSA_WITH_RC4_128_SHA",
"ECDH-RSA-RC4-SHA" },
{ 0xC011, "TLS_ECDHE_RSA_WITH_RC4_128_SHA",
"ECDHE-RSA-RC4-SHA" },
{ 0xC015, "TLS_ECDH_anon_WITH_NULL_SHA",
"AECDH-NULL-SHA" },
{ 0xC016, "TLS_ECDH_anon_WITH_RC4_128_SHA",
"AECDH-RC4-SHA" },
{ 0xC017, "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA",
"AECDH-DES-CBC3-SHA" },
{ 0xC018, "TLS_ECDH_anon_WITH_AES_128_CBC_SHA",
"AECDH-AES128-SHA" },
{ 0xC019, "TLS_ECDH_anon_WITH_AES_256_CBC_SHA",
"AECDH-AES256-SHA" },
/* Backward compatible aliases (EDH vs DHE) */
{ 0x0011, "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA",
"EXP-EDH-DSS-DES-CBC-SHA" },
{ 0x0012, "TLS_DHE_DSS_WITH_DES_CBC_SHA",
"EDH-DSS-DES-CBC-SHA" },
{ 0x0013, "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA",
"EDH-DSS-DES-CBC3-SHA" },
{ 0x0014, "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA",
"EXP-EDH-RSA-DES-CBC-SHA" },
{ 0x0015, "TLS_DHE_RSA_WITH_DES_CBC_SHA",
"EDH-RSA-DES-CBC-SHA" },
{ 0x0016, "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA",
"EDH-RSA-DES-CBC3-SHA" },
#endif
#if defined(USE_MBEDTLS)
/* entries marked ns are non-"standard", they are not in OpenSSL */
{ 0x0041, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA",
@ -608,7 +454,7 @@ struct test_str_entry {
const char *str;
};
static const struct test_str_entry test_str_list[] = {
#if defined(USE_SECTRANSP) || defined(USE_MBEDTLS) || defined(USE_RUSTLS)
#if defined(USE_MBEDTLS) || defined(USE_RUSTLS)
{ 0x1301, "TLS_AES_128_GCM_SHA256"},
{ 0x1302, "TLS_AES_256_GCM_SHA384"},
{ 0x1303, "TLS_CHACHA20_POLY1305_SHA256"},
@ -623,7 +469,7 @@ static const struct test_str_entry test_str_list[] = {
{ 0xC030, "ECDHE-RSA-AES256-GCM-SHA384"},
{ 0xCCA9, "ECDHE-ECDSA-CHACHA20-POLY1305"},
{ 0xCCA8, "ECDHE-RSA-CHACHA20-POLY1305"},
#if defined(USE_SECTRANSP) || defined(USE_MBEDTLS)
#if defined(USE_MBEDTLS)
{ 0x009E, "DHE-RSA-AES128-GCM-SHA256"},
{ 0x009F, "DHE-RSA-AES256-GCM-SHA384"},
#else
@ -635,7 +481,7 @@ static const struct test_str_entry test_str_list[] = {
#else
{ 0x0000, "DHE-RSA-CHACHA20-POLY1305"},
#endif
#if defined(USE_SECTRANSP) || defined(USE_MBEDTLS) || defined(USE_BEARSSL)
#if defined(USE_MBEDTLS)
{ 0xC023, "ECDHE-ECDSA-AES128-SHA256" },
{ 0xC027, "ECDHE-RSA-AES128-SHA256" },
{ 0xC009, "ECDHE-ECDSA-AES128-SHA" },
@ -654,14 +500,14 @@ static const struct test_str_entry test_str_list[] = {
{ 0x0000, "ECDHE-ECDSA-AES256-SHA" },
{ 0x0000, "ECDHE-RSA-AES256-SHA" },
#endif
#if defined(USE_SECTRANSP) || defined(USE_MBEDTLS)
#if defined(USE_MBEDTLS)
{ 0x0067, "DHE-RSA-AES128-SHA256" },
{ 0x006B, "DHE-RSA-AES256-SHA256" },
#else
{ 0x0000, "DHE-RSA-AES128-SHA256" },
{ 0x0000, "DHE-RSA-AES256-SHA256" },
#endif
#if defined(USE_SECTRANSP) || defined(USE_MBEDTLS) || defined(USE_BEARSSL)
#if defined(USE_MBEDTLS)
{ 0x009C, "AES128-GCM-SHA256" },
{ 0x009D, "AES256-GCM-SHA384" },
{ 0x003C, "AES128-SHA256" },
@ -676,11 +522,7 @@ static const struct test_str_entry test_str_list[] = {
{ 0x0000, "AES128-SHA" },
{ 0x0000, "AES256-SHA" },
#endif
#if defined(USE_SECTRANSP) || defined(USE_BEARSSL)
{ 0x000A, "DES-CBC3-SHA" },
#else
{ 0x0000, "DES-CBC3-SHA" },
#endif
{ 0x0000, "GIBBERISH" },
{ 0x0000, "" },
};
@ -785,11 +627,9 @@ UNITTEST_START
}
UNITTEST_STOP
#else /* defined(USE_SECTRANSP) || defined(USE_MBEDTLS) || \
defined(USE_BEARSSL) */
#else /* defined(USE_MBEDTLS) */
UNITTEST_START
UNITTEST_STOP
#endif /* defined(USE_SECTRANSP) || defined(USE_MBEDTLS) || \
defined(USE_BEARSSL) || defined(USE_RUSTLS) */
#endif /* defined(USE_MBEDTLS) || defined(USE_RUSTLS) */