romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-26 21:03:34 +03:00
Code Issues Projects Releases Packages Wiki Activity

rustls: support ECH GREASE

Browse source 
e.g. `curl --tlsv1.3 --ech grease ...`
This commit is contained in:
Daniel McCarney 2025-03-24 12:01:30 -04:00 • committed by Daniel Stenberg
parent 1c8c93ae15
commit 233b668903
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 65 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

53
lib/vtls/rustls.c
View file

@ -588,6 +588,14 @@ init_config_builder(struct Curl_easy *data,
goto cleanup;
}
#if defined(USE_ECH)
if(ECH_ENABLED(data)) {
tls_versions[0] = RUSTLS_TLS_VERSION_TLSV1_3;
tls_versions_len = 1;
infof(data, "rustls: ECH enabled, forcing TLSv1.3");
}
#endif /* USE_ECH */
cipher_suites = malloc(sizeof(cipher_suites) * (cipher_suites_len));
if(!cipher_suites) {
result = CURLE_OUT_OF_MEMORY;
@ -889,6 +897,38 @@ cleanup:
return result;
}
#if defined(USE_ECH)
static CURLcode
init_config_builder_ech(struct Curl_easy *data,
struct rustls_client_config_builder *builder)
{
const rustls_hpke *hpke = rustls_supported_hpke();
if(!hpke) {
failf(data,
"rustls: ECH unavailable, rustls-ffi built without "
"HPKE compatible crypto provider");
return CURLE_SSL_CONNECT_ERROR;
}
if(data->set.str[STRING_ECH_PUBLIC]) {
failf(data, "rustls: ECH outername not supported");
return CURLE_SSL_CONNECT_ERROR;
}
if(data->set.tls_ech == CURLECH_GREASE) {
rustls_result rr;
rr = rustls_client_config_builder_enable_ech_grease(builder, hpke);
if(rr != RUSTLS_RESULT_OK) {
rustls_failf(data, rr, "rustls: failed to configure ECH GREASE");
return CURLE_SSL_CONNECT_ERROR;
}
}
return CURLE_OK;
}
#endif /* USE_ECH */
static CURLcode
cr_init_backend(struct Curl_cfilter *cf, struct Curl_easy *data,
struct rustls_ssl_backend_data *const backend)
@ -946,6 +986,16 @@ cr_init_backend(struct Curl_cfilter *cf, struct Curl_easy *data,
}
}
#if defined(USE_ECH)
if(ECH_ENABLED(data)) {
result = init_config_builder_ech(data, config_builder);
if(result != CURLE_OK && data->set.tls_ech & CURLECH_HARD) {
rustls_client_config_builder_free(config_builder);
return result;
}
}
#endif /* USE_ECH */
result = init_config_builder_keylog(data, config_builder);
if(result != CURLE_OK) {
rustls_client_config_builder_free(config_builder);
@ -1269,7 +1319,8 @@ const struct Curl_ssl Curl_ssl_rustls = {
SSLSUPP_HTTPS_PROXY |
SSLSUPP_CIPHER_LIST |
SSLSUPP_TLS13_CIPHERSUITES |
SSLSUPP_CERTINFO,
SSLSUPP_CERTINFO |
SSLSUPP_ECH,
sizeof(struct rustls_ssl_backend_data),
NULL, /* init */