romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-04-15 00:41:41 +03:00
Code Issues Projects Releases Packages Wiki Activity

tls: remove checks for DEFAULT

Browse source 
Since 9d8998c994, the setopt code changes input DEFAULT to an
actual more specific TLS version (1.2) for the backends to use and check
for.

This means that the default value (0L) cannot and should not actually be
used when the TLS backends run. This change adds asserts to verify that
and removes code that accepts the DEFAULT value as a valid version with
the TLS version functions' logic.

Applications can still set a specific lower version if they want (1, 1.0
or 1.1).

Closes #20453
This commit is contained in:
Daniel Stenberg 2026-01-27 16:59:32 +01:00
parent ae99d750dd
commit 1b50dcc2ab
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
6 changed files with 9 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

4
lib/vtls/gtls.c
View file

@ -323,8 +323,8 @@ gnutls_set_ssl_version_min_max(struct Curl_easy *data,
long ssl_version = conn_config->version;
long ssl_version_max = conn_config->version_max;
if((ssl_version == CURL_SSLVERSION_DEFAULT) ||
(ssl_version == CURL_SSLVERSION_TLSv1))
DEBUGASSERT(ssl_version != CURL_SSLVERSION_DEFAULT);
if(ssl_version <= CURL_SSLVERSION_TLSv1)
ssl_version = CURL_SSLVERSION_TLSv1_0;
if((ssl_version_max == CURL_SSLVERSION_MAX_NONE) ||
(ssl_version_max == CURL_SSLVERSION_MAX_DEFAULT))

2
lib/vtls/mbedtls.c
View file

@ -198,8 +198,8 @@ mbed_set_ssl_version_min_max(struct Curl_easy *data,
#endif
;
DEBUGASSERT(conn_config->version != CURL_SSLVERSION_DEFAULT);
switch(conn_config->version) {
case CURL_SSLVERSION_DEFAULT:
case CURL_SSLVERSION_TLSv1:
case CURL_SSLVERSION_TLSv1_0:
case CURL_SSLVERSION_TLSv1_1:

4
lib/vtls/openssl.c
View file

@ -3620,11 +3620,11 @@ static CURLcode ossl_init_method(struct Curl_cfilter *cf,
*pmethod = NULL;
*pssl_version_min = conn_config->version;
DEBUGASSERT(conn_config->version != CURL_SSLVERSION_DEFAULT);
switch(peer->transport) {
case TRNSPRT_TCP:
/* check to see if we have been told to use an explicit SSL/TLS version */
switch(*pssl_version_min) {
case CURL_SSLVERSION_DEFAULT:
case CURL_SSLVERSION_TLSv1:
case CURL_SSLVERSION_TLSv1_0:
case CURL_SSLVERSION_TLSv1_1:
@ -3770,13 +3770,13 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
if(!ssl_config->enable_beast)
ctx_options &= ~(ctx_option_t)SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
DEBUGASSERT(ssl_version_min != CURL_SSLVERSION_DEFAULT);
switch(ssl_version_min) {
case CURL_SSLVERSION_SSLv2:
case CURL_SSLVERSION_SSLv3:
return CURLE_NOT_BUILT_IN;
/* "--tlsv<x.y>" options mean TLS >= version <x.y> */
case CURL_SSLVERSION_DEFAULT:
case CURL_SSLVERSION_TLSv1: /* TLS >= version 1.0 */
case CURL_SSLVERSION_TLSv1_0: /* TLS >= version 1.0 */
case CURL_SSLVERSION_TLSv1_1: /* TLS >= version 1.1 */

2
lib/vtls/rustls.c
View file

@ -533,8 +533,8 @@ init_config_builder(struct Curl_easy *data,
CURLcode result = CURLE_OK;
rustls_result rr;
DEBUGASSERT(conn_config->version != CURL_SSLVERSION_DEFAULT);
switch(conn_config->version) {
case CURL_SSLVERSION_DEFAULT:
case CURL_SSLVERSION_TLSv1:
case CURL_SSLVERSION_TLSv1_0:
case CURL_SSLVERSION_TLSv1_1:

2
lib/vtls/schannel.c
View file

@ -428,8 +428,8 @@ static CURLcode schannel_acquire_credential_handle(struct Curl_cfilter *cf,
else
infof(data, "schannel: enabled automatic use of client certificate");
DEBUGASSERT(conn_config->version != CURL_SSLVERSION_DEFAULT);
switch(conn_config->version) {
case CURL_SSLVERSION_DEFAULT:
case CURL_SSLVERSION_TLSv1:
case CURL_SSLVERSION_TLSv1_0:
case CURL_SSLVERSION_TLSv1_1:

3
lib/vtls/wolfssl.c
View file

@ -1028,8 +1028,9 @@ static CURLcode ssl_version(struct Curl_easy *data,
{
int res;
*min_version = *max_version = 0;
DEBUGASSERT(conn_config->version != CURL_SSLVERSION_DEFAULT);
switch(conn_config->version) {
case CURL_SSLVERSION_DEFAULT:
case CURL_SSLVERSION_TLSv1:
case CURL_SSLVERSION_TLSv1_0:
*min_version = TLS1_VERSION;