romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 13:33:36 +03:00
Code Issues Projects Releases Packages Wiki Activity

BearSSL: add CURLOPT_SSL_CIPHER_LIST support

Browse source 
Closes #8477
This commit is contained in:
Jan Venekamp 2021-12-06 18:36:03 +01:00 • committed by Daniel Stenberg
parent 3055c4c814
commit f5d79619b1
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
4 changed files with 295 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

58
docs/CIPHERS.md
View file

@ -520,3 +520,61 @@ to [constrain the set of available ciphers as specified in the schannel
documentation](https://docs.microsoft.com/en-us/windows/win32/secauthn/tls-cipher-suites-in-windows-server-2022).
Note that the supported ciphers in this case follow the OS version, so if you
are running an outdated OS you might still be supporting weak ciphers.
## BearSSL
BearSSL ciphers can be specified by either the OpenSSL name (`ECDHE-RSA-AES128-GCM-SHA256`) or the IANA name (`TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256`).
Since BearSSL 0.1:
`DES-CBC3-SHA`
`AES128-SHA`
`AES256-SHA`
`AES128-SHA256`
`AES256-SHA256`
`AES128-GCM-SHA256`
`AES256-GCM-SHA384`
`ECDH-ECDSA-DES-CBC3-SHA`
`ECDH-ECDSA-AES128-SHA`
`ECDH-ECDSA-AES256-SHA`
`ECDHE-ECDSA-DES-CBC3-SHA`
`ECDHE-ECDSA-AES128-SHA`
`ECDHE-ECDSA-AES256-SHA`
`ECDH-RSA-DES-CBC3-SHA`
`ECDH-RSA-AES128-SHA`
`ECDH-RSA-AES256-SHA`
`ECDHE-RSA-DES-CBC3-SHA`
`ECDHE-RSA-AES128-SHA`
`ECDHE-RSA-AES256-SHA`
`ECDHE-ECDSA-AES128-SHA256`
`ECDHE-ECDSA-AES256-SHA384`
`ECDH-ECDSA-AES128-SHA256`
`ECDH-ECDSA-AES256-SHA384`
`ECDHE-RSA-AES128-SHA256`
`ECDHE-RSA-AES256-SHA384`
`ECDH-RSA-AES128-SHA256`
`ECDH-RSA-AES256-SHA384`
`ECDHE-ECDSA-AES128-GCM-SHA256`
`ECDHE-ECDSA-AES256-GCM-SHA384`
`ECDH-ECDSA-AES128-GCM-SHA256`
`ECDH-ECDSA-AES256-GCM-SHA384`
`ECDHE-RSA-AES128-GCM-SHA256`
`ECDHE-RSA-AES256-GCM-SHA384`
`ECDH-RSA-AES128-GCM-SHA256`
`ECDH-RSA-AES256-GCM-SHA384`
Since BearSSL 0.2:
`ECDHE-RSA-CHACHA20-POLY1305`
`ECDHE-ECDSA-CHACHA20-POLY1305`
Since BearSSL 0.6:
`AES128-CCM`
`AES256-CCM`
`AES128-CCM8`
`AES256-CCM8`
`ECDHE-ECDSA-AES128-CCM`
`ECDHE-ECDSA-AES256-CCM`
`ECDHE-ECDSA-AES128-CCM8`
`ECDHE-ECDSA-AES256-CCM8`

9
docs/libcurl/opts/CURLOPT_PROXY_SSL_CIPHER_LIST.3
View file

@ -49,6 +49,13 @@ enabled.
For WolfSSL, valid examples of cipher lists include \fBECDHE-RSA-RC4-SHA\fP,
\fBAES256-SHA:AES256-SHA256\fP, etc.
For BearSSL, valid examples of cipher lists include
\fBECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256\fP, or when using IANA names
\fBTLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\fP,
etc.
With BearSSL you do not add/remove ciphers. If one uses this option then all
known ciphers are disabled and only those passed in are enabled.
you will find more details about cipher lists on this URL:
https://curl.se/docs/ssl-ciphers.html
@ -71,7 +78,7 @@ if(curl) {
}
.fi
.SH AVAILABILITY
Added in 7.52.0
Added in 7.52.0, in 7.83.0 for BearSSL
If built TLS enabled.
.SH RETURN VALUE

9
docs/libcurl/opts/CURLOPT_SSL_CIPHER_LIST.3
View file

@ -48,6 +48,13 @@ enabled.
For WolfSSL, valid examples of cipher lists include \fBECDHE-RSA-RC4-SHA\fP,
\fBAES256-SHA:AES256-SHA256\fP, etc.
For BearSSL, valid examples of cipher lists include
\fBECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256\fP, or when using IANA names
\fBTLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\fP,
etc.
With BearSSL you do not add/remove ciphers. If one uses this option then all
known ciphers are disabled and only those passed in are enabled.
you will find more details about cipher lists on this URL:
https://curl.se/docs/ssl-ciphers.html
@ -69,6 +76,8 @@ if(curl) {
}
.fi
.SH AVAILABILITY
Added in 7.9, in 7.83.0 for BearSSL
If built TLS enabled.
.SH RETURN VALUE
Returns CURLE_OK if TLS is supported, CURLE_UNKNOWN_OPTION if not, or