romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 20:53:37 +03:00
Code Issues Projects Releases Packages Wiki Activity

mbedTLS: implement CURLOPT_SSL_CIPHER_LIST option

Browse source 
Use a lookup list to set the cipher suites, allowing the
ciphers to be set by either openssl or IANA names.

To keep the binary size of the lookup list down we compress
each entry in the cipher list down to 2 + 6 bytes using the
C preprocessor.

Closes #13442
This commit is contained in:
Jan Venekamp 2024-04-23 17:42:45 +02:00 • committed by Daniel Stenberg
parent 43299e93c0
commit fba9afebba
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
11 changed files with 1485 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

14
docs/libcurl/opts/CURLOPT_PROXY_SSL_CIPHER_LIST.md
View file

@ -19,6 +19,7 @@ TLS-backend:
- Secure Transport
- wolfSSL
- GnuTLS
- mbedTLS
---
# NAME
@ -49,12 +50,13 @@ set when you compile OpenSSL.
For WolfSSL, valid examples of cipher lists include **ECDHE-RSA-RC4-SHA**,
**AES256-SHA:AES256-SHA256**, etc.
For BearSSL, valid examples of cipher lists include
**ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256**, or when using IANA names
For mbedTLS and BearSSL, valid examples of cipher lists include
**ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256**, or when using
IANA names
**TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256**,
etc.
With BearSSL you do not add/remove ciphers. If one uses this option then all
known ciphers are disabled and only those passed in are enabled.
etc. With mbedTLS and BearSSL you do not add/remove ciphers. If one uses this
option then all known ciphers are disabled and only those passed in are
enabled.
Find more details about cipher lists on this URL:
@ -86,7 +88,7 @@ int main(void)
# AVAILABILITY
Added in 7.52.0, in 7.83.0 for BearSSL
Added in 7.52.0, in 7.83.0 for BearSSL, in 8.8.0 for mbedTLS
If built TLS enabled.

10
docs/libcurl/opts/CURLOPT_SSL_CIPHER_LIST.md
View file

@ -19,6 +19,7 @@ TLS-backend:
- Secure Transport
- wolfSSL
- GnuTLS
- mbedTLS
---
# NAME
@ -48,12 +49,13 @@ you compile OpenSSL.
For WolfSSL, valid examples of cipher lists include **ECDHE-RSA-RC4-SHA**,
**AES256-SHA:AES256-SHA256**, etc.
For BearSSL, valid examples of cipher lists include
For mbedTLS and BearSSL, valid examples of cipher lists include
**ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256**, or when using
IANA names
**TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256**,
etc. With BearSSL you do not add/remove ciphers. If one uses this option then
all known ciphers are disabled and only those passed in are enabled.
etc. With mbedTLS and BearSSL you do not add/remove ciphers. If one uses this
option then all known ciphers are disabled and only those passed in are
enabled.
For Schannel, you can use this option to set algorithms but not specific
cipher suites. Refer to the ciphers lists document for algorithms.
@ -87,7 +89,7 @@ int main(void)
# AVAILABILITY
Added in 7.9, in 7.83.0 for BearSSL
Added in 7.9, in 7.83.0 for BearSSL, in 8.8.0 for mbedTLS
If built TLS enabled.