romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 06:53:31 +03:00
Code Issues Projects Releases Packages Wiki Activity

mbedtls: add CURLOPT_TLS13_CIPHERS support

Browse source 
Bring setting ciphers with mbedTLS in line with other SSL backends,
to make the curl interface more consistent across the backends.

Now the tls1.3 ciphers are set with the --tls13-ciphers option, when
not set the default tls1.3 ciphers are used. The tls1.2 (1.1, 1.0)
ciphers are set with the --ciphers option, when not set the default
tls1.2 ciphers are used. The ciphers available for the connection
are now a union of the tls1.3 and tls1.2 ciphers.

This changes the behaviour for mbedTLS when --ciphers is set, but
--tls13-ciphers is not set. Now the ciphers set with --ciphers
are combined with the default tls1.3 ciphers, whereas before solely
the ciphers of --ciphers were used.

Thus before when no tls1.3 ciphers were specified in --ciphers,
tls1.3 was completely disabled. This might not be what the user
expected, especially as this does not happen with OpenSSL.

Closes #14384
This commit is contained in:
Jan Venekamp 2024-08-04 20:06:27 +02:00 • committed by Daniel Stenberg
parent d266d19d86
commit 3f7dc8a404
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
2 changed files with 64 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

6
tests/http/test_17_ssl_use.py
View file

@ -213,10 +213,8 @@ class TestSSLUse:
pytest.skip('SecureTransport does not support TLSv1.3')
elif env.curl_uses_lib('boringssl'):
pytest.skip('BoringSSL does not support setting TLSv1.3 ciphers')
elif env.curl_uses_lib('mbedtls'):
if not env.curl_lib_version_at_least('mbedtls', '3.6.0'):
pytest.skip('mbedTLS TLSv1.3 support requires at least 3.6.0')
extra_args = ['--ciphers', ':'.join(cipher_names)]
elif env.curl_uses_lib('mbedtls') and not env.curl_lib_version_at_least('mbedtls', '3.6.0'):
pytest.skip('mbedTLS TLSv1.3 support requires at least 3.6.0')
elif env.curl_uses_lib('wolfssl'):
extra_args = ['--ciphers', ':'.join(cipher_names)]
else: