romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-04 04:00:00 +03:00
Code Issues Projects Releases Packages Wiki Activity

schannel: remove TLS 1.3 ciphersuite-list support

Browse source 
Drop TLS 1.3 ciphersuite-list support from SChannel because of the
number of bugs in SChannel itself (a closed-source TLS library). TLS 1.3
with SChannel still works, however the ciphersuite negotiation is left
entirely to SChannel.

Bug: https://hackerone.com/reports/2792484
Reported-by: newfunction on hackerone

Fixes https://github.com/curl/curl/issues/15482
Closes https://github.com/curl/curl/pull/15621
This commit is contained in:
Wyatt O'Day 2024-11-21 09:08:31 -05:00 • committed by Jay Satiro
parent e233073f01
commit 6238888ca7
5 changed files with 8 additions and 206 deletions
Download patch file Download diff file Expand all files Collapse all files

10
docs/CIPHERS.md
View file

@ -42,8 +42,7 @@ common cipher suite in the list sent by curl is chosen.
Setting TLS 1.3 cipher suites is supported by curl with
OpenSSL (1.1.1+, curl 7.61.0+), LibreSSL (3.4.1+, curl 8.3.0+),
wolfSSL (curl 8.10.0+), mbedTLS (3.6.0+, curl 8.10.0+) and
Schannel (curl 7.85.0+).
wolfSSL (curl 8.10.0+) and mbedTLS (3.6.0+, curl 8.10.0+).
The list of cipher suites that can be used for the `--tls13-ciphers` option:
```
@ -61,13 +60,6 @@ In addition to above list the following cipher suites can be used:
Usage of these cipher suites is not recommended. (The last two cipher suites
are NULL ciphers, offering no encryption whatsoever.)
### Schannel notes
Schannel does not support setting individual TLS 1.3 cipher suites directly.
To support `--tls13-ciphers` curl emulates it by adding or restricting
algorithms to use. Due to this the specified order of preference of the
cipher suites is not taken into account.
## TLS 1.2 (1.1, 1.0) cipher suites
Setting TLS 1.2 cipher suites is supported by curl with OpenSSL, LibreSSL,

2
docs/cmdline-opts/tls13-ciphers.md
View file

@ -25,7 +25,7 @@ cipher suite details on this URL:
https://curl.se/docs/ssl-ciphers.html
This option is used when curl is built to use OpenSSL 1.1.1 or later,
Schannel, wolfSSL, or mbedTLS 3.6.0 or later.
wolfSSL, or mbedTLS 3.6.0 or later.
Before curl 8.10.0 with mbedTLS or wolfSSL, TLS 1.3 cipher suites were set
by using the --ciphers option.

2
docs/libcurl/opts/CURLOPT_PROXY_TLS13_CIPHERS.md
View file

@ -14,7 +14,6 @@ Protocol:
- TLS
TLS-backend:
- OpenSSL
- Schannel
- wolfSSL
- mbedTLS
- rustls
@ -84,7 +83,6 @@ int main(void)
# HISTORY
OpenSSL support added in 7.61.0, available when built with OpenSSL \>= 1.1.1.
Schannel support added in 7.87.0.
LibreSSL support added in 8.3.0, available when built with LibreSSL \>= 3.4.1.
wolfSSL support added in 8.10.0.
mbedTLS support added in 8.10.0, available when built with mbedTLS \>= 3.6.0.

2
docs/libcurl/opts/CURLOPT_TLS13_CIPHERS.md
View file

@ -15,7 +15,6 @@ Protocol:
- TLS
TLS-backend:
- OpenSSL
- Schannel
- wolfSSL
- mbedTLS
- rustls
@ -84,7 +83,6 @@ int main(void)
# HISTORY
OpenSSL support added in 7.61.0, available when built with OpenSSL \>= 1.1.1.
Schannel support added in 7.85.0.
LibreSSL support added in 8.3.0, available when built with LibreSSL \>= 3.4.1.
wolfSSL support added in 8.10.0.
mbedTLS support added in 8.10.0, available when built with mbedTLS \>= 3.6.0.