romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-24 17:53:33 +03:00
Code Issues Projects Releases Packages Wiki Activity

schannel: Add TLS 1.3 support

Browse source 
- Support TLS 1.3 as the default max TLS version for Windows Server 2022
  and Windows 11.

- Support specifying TLS 1.3 ciphers via existing option
  CURLOPT_TLS13_CIPHERS (tool: --tls13-ciphers).

Closes https://github.com/curl/curl/pull/8419
This commit is contained in:
Wyatt O'Day 2022-07-22 10:45:28 -04:00 • committed by Jay Satiro
parent 92179353e5
commit 8beff43559
5 changed files with 434 additions and 64 deletions
Download patch file Download diff file Expand all files Collapse all files

13
docs/CIPHERS.md
View file

@ -6,7 +6,8 @@ and
[`--ciphers`](https://curl.se/docs/manpage.html#--ciphers)
users can control which ciphers to consider when negotiating TLS connections.
TLS 1.3 ciphers are supported since curl 7.61 for OpenSSL 1.1.1+ with options
TLS 1.3 ciphers are supported since curl 7.61 for OpenSSL 1.1.1+, and since
curl 7.85 for SChannel with options
[`CURLOPT_TLS13_CIPHERS`](https://curl.se/libcurl/c/CURLOPT_TLS13_CIPHERS.html)
and
[`--tls13-ciphers`](https://curl.se/docs/manpage.html#--tls13-ciphers)
@ -521,6 +522,16 @@ documentation](https://docs.microsoft.com/en-us/windows/win32/secauthn/tls-ciphe
Note that the supported ciphers in this case follow the OS version, so if you
are running an outdated OS you might still be supporting weak ciphers.
### TLS 1.3 cipher suites
(Note these ciphers are set with `CURLOPT_TLS13_CIPHERS` and `--tls13-ciphers`)
`TLS_AES_256_GCM_SHA384`
`TLS_AES_128_GCM_SHA256`
`TLS_CHACHA20_POLY1305_SHA256`
`TLS_AES_128_CCM_8_SHA256`
`TLS_AES_128_CCM_SHA256`
## BearSSL
BearSSL ciphers can be specified by either the OpenSSL name (`ECDHE-RSA-AES128-GCM-SHA256`) or the IANA name (`TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256`).

2
docs/libcurl/opts/CURLOPT_PROXY_TLS13_CIPHERS.3
View file

@ -58,7 +58,7 @@ CURL *curl = curl_easy_init();
if(curl) {
curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
curl_easy_setopt(curl, CURLOPT_PROXY_TLS13_CIPHERS,
"TLS13-CHACHA20-POLY1305-SHA256");
"TLS_CHACHA20_POLY1305_SHA256");
ret = curl_easy_perform(curl);
curl_easy_cleanup(curl);
}

11
docs/libcurl/opts/CURLOPT_TLS13_CIPHERS.3
View file

@ -41,8 +41,8 @@ you will find more details about cipher lists on this URL:
https://curl.se/docs/ssl-ciphers.html
This option is currently used only when curl is built to use OpenSSL 1.1.1 or
later. If you are using a different SSL backend you can try setting TLS 1.3
cipher suites by using the CURLOPT_SSL_CIPHER_LIST option.
later or SChannel. If you are using a different SSL backend you can try
setting TLS 1.3 cipher suites by using the CURLOPT_SSL_CIPHER_LIST option.
The application does not have to keep the string around after setting this
option.
@ -56,14 +56,15 @@ CURL *curl = curl_easy_init();
if(curl) {
curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
curl_easy_setopt(curl, CURLOPT_TLS13_CIPHERS,
"TLS13-CHACHA20-POLY1305-SHA256");
"TLS_CHACHA20_POLY1305_SHA256");
ret = curl_easy_perform(curl);
curl_easy_cleanup(curl);
}
.fi
.SH AVAILABILITY
Added in 7.61.0.
Available when built with OpenSSL >= 1.1.1.
Added in 7.61.0 for OpenSSL. Available when built with OpenSSL >= 1.1.1.
Added in 7.85.0 for SChannel.
.SH RETURN VALUE
Returns CURLE_OK if supported, CURLE_NOT_BUILT_IN otherwise.
.SH "SEE ALSO"