romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 03:43:31 +03:00
Code Issues Projects Releases Packages Wiki Activity

tls: make default TLS version be minimum 1.2

Browse source 
This still allows users to explictily ask for 1.0 or 1.1 as the minimum
version. If the TLS library allows it.

Starting with this change, the CURL_SSLVERSION_DEFAULT value is no
longer used as minimum version when the TLS backend are called.

This also makes curl set the minimum version to 1.2 independently of
libcurl for the rare case where a newer curl tool would use an older
libcurl.

URL: https://curl.se/mail/lib-2025-07/0007.html
Assisted-by: Stefan Eissing
Closes #17894
This commit is contained in:
Daniel Stenberg 2025-07-11 08:14:42 +02:00
parent 0e022d4241
commit 9d8998c994
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
23 changed files with 206 additions and 84 deletions
Download patch file Download diff file Expand all files Collapse all files

29
src/tool_getparam.c
View file

@ -1682,10 +1682,23 @@ static void opt_depr(struct GlobalConfig *global,
warnf(global, "--%s is deprecated and has no function anymore", a->lname);
}
static ParameterError opt_sslver(struct OperationConfig *config,
unsigned char ver)
{
if(config->ssl_version_max &&
(config->ssl_version_max < ver)) {
errorf(config->global, "Minimum TLS version set higher than max");
return PARAM_BAD_USE;
}
config->ssl_version = ver;
return PARAM_OK;
}
/* opt_none is the function that handles ARG_NONE options */
static ParameterError opt_none(struct OperationConfig *config,
const struct LongShort *a)
{
ParameterError err = PARAM_OK;
switch(a->cmd) {
case C_ANYAUTH: /* --anyauth */
config->authtype = CURLAUTH_ANY;
@ -1731,19 +1744,19 @@ static ParameterError opt_none(struct OperationConfig *config,
sethttpver(config, CURL_HTTP_VERSION_3ONLY);
break;
case C_TLSV1: /* --tlsv1 */
config->ssl_version = CURL_SSLVERSION_TLSv1;
err = opt_sslver(config, 1);
break;
case C_TLSV1_0: /* --tlsv1.0 */
config->ssl_version = CURL_SSLVERSION_TLSv1_0;
err = opt_sslver(config, 1);
break;
case C_TLSV1_1: /* --tlsv1.1 */
config->ssl_version = CURL_SSLVERSION_TLSv1_1;
err = opt_sslver(config, 2);
break;
case C_TLSV1_2: /* --tlsv1.2 */
config->ssl_version = CURL_SSLVERSION_TLSv1_2;
err = opt_sslver(config, 3);
break;
case C_TLSV1_3: /* --tlsv1.3 */
config->ssl_version = CURL_SSLVERSION_TLSv1_3;
err = opt_sslver(config, 4);
break;
case C_IPV4: /* --ipv4 */
config->ip_version = CURL_IPRESOLVE_V4;
@ -1758,7 +1771,7 @@ static ParameterError opt_none(struct OperationConfig *config,
config->proxy_ssl_version = CURL_SSLVERSION_TLSv1;
break;
}
return PARAM_OK;
return err;
}
/* opt_bool is the function that handles boolean options */
@ -2423,6 +2436,10 @@ static ParameterError opt_filestring(struct OperationConfig *config,
break;
case C_TLS_MAX: /* --tls-max */
err = str2tls_max(&config->ssl_version_max, nextarg);
if(!err && (config->ssl_version_max < config->ssl_version)) {
errorf(global, "--tls-max set lower than minimum accepted version");
err = PARAM_BAD_USE;
}
break;
case C_HAPPY_EYEBALLS_TIMEOUT_MS: /* --happy-eyeballs-timeout-ms */
err = str2unum(&config->happy_eyeballs_timeout_ms, nextarg);