vtls: support TLS 1.3 via CURL_SSLVERSION_TLSv1_3

Fully implemented with the NSS backend only for now.

Reviewed-by: Ray Satiro

diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index 9a4737820f4c52f0997c6876df15b747895b37ea..0917c683a321f683f89102833eef7fb753fa9c81 100644 (file)
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -9,6 +9,7 @@ Curl and libcurl 7.51.1
 This release includes the following changes:
 
  o nss: map CURL_SSLVERSION_DEFAULT to NSS default
+ o vtls: support TLS 1.3 via CURL_SSLVERSION_TLSv1_3
  o
 
 This release includes the following bugfixes:

diff --git a/docs/libcurl/opts/CURLOPT_SSLVERSION.3 b/docs/libcurl/opts/CURLOPT_SSLVERSION.3
index 2f40e4631ade6d87da61b9052747957e4b530703..1854af03cbaa1a1aef6154549f9e3041e6b96cb0 100644 (file)
--- a/docs/libcurl/opts/CURLOPT_SSLVERSION.3
+++ b/docs/libcurl/opts/CURLOPT_SSLVERSION.3
@@ -48,6 +48,8 @@ TLSv1.0 (Added in 7.34.0)
 TLSv1.1 (Added in 7.34.0)
 .IP CURL_SSLVERSION_TLSv1_2
 TLSv1.2 (Added in 7.34.0)
+.IP CURL_SSLVERSION_TLSv1_3
+TLSv1.3 (Added in 7.51.1)
 .RE
 .SH DEFAULT
 CURL_SSLVERSION_DEFAULT

diff --git a/docs/libcurl/symbols-in-versions b/docs/libcurl/symbols-in-versions
index f6365ae1156a3c411bcf262044c20242707526b7..a77fde44094907e09ccebd234358adc35d4c598e 100644 (file)
--- a/docs/libcurl/symbols-in-versions
+++ b/docs/libcurl/symbols-in-versions
@@ -773,6 +773,7 @@ CURL_SSLVERSION_TLSv1           7.9.2
 CURL_SSLVERSION_TLSv1_0         7.34.0
 CURL_SSLVERSION_TLSv1_1         7.34.0
 CURL_SSLVERSION_TLSv1_2         7.34.0
+CURL_SSLVERSION_TLSv1_3         7.51.1
 CURL_TIMECOND_IFMODSINCE        7.9.7
 CURL_TIMECOND_IFUNMODSINCE      7.9.7
 CURL_TIMECOND_LASTMOD           7.9.7

diff --git a/include/curl/curl.h b/include/curl/curl.h
index 9c09cb966ec0d7faee727cd2a875c323155d5a5b..03fcfebc3960c8bc9fbd0f00fb3f3e5753d679a0 100644 (file)
--- a/include/curl/curl.h
+++ b/include/curl/curl.h
@@ -1805,6 +1805,7 @@ enum {
   CURL_SSLVERSION_TLSv1_0,
   CURL_SSLVERSION_TLSv1_1,
   CURL_SSLVERSION_TLSv1_2,
+  CURL_SSLVERSION_TLSv1_3,
 
   CURL_SSLVERSION_LAST /* never use, keep last */
 };

diff --git a/lib/vtls/darwinssl.c b/lib/vtls/darwinssl.c
index 66e74f1ba564859196a1c2c04570056c4c799a7e..6aa30d451b637fe28725914ba03a826f62ff0c0d 100644 (file)
--- a/lib/vtls/darwinssl.c
+++ b/lib/vtls/darwinssl.c
@@ -1071,6 +1071,9 @@ static CURLcode darwinssl_connect_step1(struct connectdata *conn,
         (void)SSLSetProtocolVersionMin(connssl->ssl_ctx, kTLSProtocol12);
         (void)SSLSetProtocolVersionMax(connssl->ssl_ctx, kTLSProtocol12);
         break;
+      case CURL_SSLVERSION_TLSv1_3:
+        failf(data, "TLSv1.3 is not yet supported with this TLS backend");
+        return CURLE_SSL_CONNECT_ERROR;
       case CURL_SSLVERSION_SSLv3:
         err = SSLSetProtocolVersionMin(connssl->ssl_ctx, kSSLProtocol3);
         if(err != noErr) {
@@ -1122,6 +1125,9 @@ static CURLcode darwinssl_connect_step1(struct connectdata *conn,
                                            kTLSProtocol12,
                                            true);
         break;
+      case CURL_SSLVERSION_TLSv1_3:
+        failf(data, "TLSv1.3 is not yet supported with this TLS backend");
+        return CURLE_SSL_CONNECT_ERROR;
       case CURL_SSLVERSION_SSLv3:
         err = SSLSetProtocolVersionEnabled(connssl->ssl_ctx,
                                            kSSLProtocol3,
@@ -1160,6 +1166,9 @@ static CURLcode darwinssl_connect_step1(struct connectdata *conn,
     case CURL_SSLVERSION_TLSv1_2:
       failf(data, "Your version of the OS does not support TLSv1.2");
       return CURLE_SSL_CONNECT_ERROR;
+    case CURL_SSLVERSION_TLSv1_3:
+      failf(data, "Your version of the OS does not support TLSv1.3");
+      return CURLE_SSL_CONNECT_ERROR;
     case CURL_SSLVERSION_SSLv2:
       err = SSLSetProtocolVersionEnabled(connssl->ssl_ctx,
                                          kSSLProtocol2,

diff --git a/lib/vtls/gskit.c b/lib/vtls/gskit.c
index 3b0cfd5a0ab7047ccda3d28fe9758386c1c0ba0d..9760c93ab86a11c63ae5fed42ad7be8f8b133157 100644 (file)
--- a/lib/vtls/gskit.c
+++ b/lib/vtls/gskit.c
@@ -639,6 +639,9 @@ static CURLcode gskit_connect_step1(struct connectdata *conn, int sockindex)
   case CURL_SSLVERSION_TLSv1_2:
     protoflags = CURL_GSKPROTO_TLSV12_MASK;
     break;
+  case CURL_SSLVERSION_TLSv1_3:
+    failf(data, "TLS 1.3 not yet supported");
+    return CURLE_SSL_CIPHER;
   }
 
   /* Process SNI. Ignore if not supported (on OS400 < V7R1). */

diff --git a/lib/vtls/gtls.c b/lib/vtls/gtls.c
index 5c87c7fe31716272ae1551da54c6c7fc59c78041..d47d80fc54e4e28d45bf980a29512a3f84365946 100644 (file)
--- a/lib/vtls/gtls.c
+++ b/lib/vtls/gtls.c
@@ -569,6 +569,9 @@ gtls_connect_step1(struct connectdata *conn,
       break;
     case CURL_SSLVERSION_TLSv1_2:
       protocol_priority[0] = GNUTLS_TLS1_2;
+    case CURL_SSLVERSION_TLSv1_3:
+      failf(data, "GnuTLS does not support TLSv1.3");
+      return CURLE_SSL_CONNECT_ERROR;
     break;
       case CURL_SSLVERSION_SSLv2:
     default:
@@ -607,6 +610,9 @@ gtls_connect_step1(struct connectdata *conn,
       prioritylist = GNUTLS_CIPHERS ":-VERS-SSL3.0:-VERS-TLS-ALL:"
                      "+VERS-TLS1.2:" GNUTLS_SRP;
       break;
+    case CURL_SSLVERSION_TLSv1_3:
+      failf(data, "GnuTLS does not support TLSv1.3");
+      return CURLE_SSL_CONNECT_ERROR;
     case CURL_SSLVERSION_SSLv2:
     default:
       failf(data, "GnuTLS does not support SSLv2");

diff --git a/lib/vtls/nss.c b/lib/vtls/nss.c
index 5abb574271e7592a85526d45bbb7e89abd40171a..5e52727276ce0581f9c61d46ab9c755e5e08c31b 100644 (file)
--- a/lib/vtls/nss.c
+++ b/lib/vtls/nss.c
@@ -1541,6 +1541,14 @@ static CURLcode nss_init_sslver(SSLVersionRange *sslver,
 #endif
     break;
 
+  case CURL_SSLVERSION_TLSv1_3:
+#ifdef SSL_LIBRARY_VERSION_TLS_1_3
+    sslver->min = SSL_LIBRARY_VERSION_TLS_1_3;
+    sslver->max = SSL_LIBRARY_VERSION_TLS_1_3;
+    return CURLE_OK;
+#endif
+    break;
+
   default:
     /* unsupported SSL/TLS version */
     break;

diff --git a/lib/vtls/polarssl.c b/lib/vtls/polarssl.c
index 18b564e02dd974c55537c2362f6738d3f3023bb2..4e41315b6aad4493d1d2e9c40e367a478ce7a8db 100644 (file)
--- a/lib/vtls/polarssl.c
+++ b/lib/vtls/polarssl.c
@@ -306,6 +306,9 @@ polarssl_connect_step1(struct connectdata *conn,
                         SSL_MINOR_VERSION_3);
     infof(data, "PolarSSL: Forced min. SSL Version to be TLS 1.2\n");
     break;
+  case CURL_SSLVERSION_TLSv1_3:
+    failf(data, "PolarSSL: TLS 1.3 is not yet supported");
+    return CURLE_SSL_CONNECT_ERROR;
   }
 
   ssl_set_endpoint(&connssl->ssl, SSL_IS_CLIENT);

diff --git a/lib/vtls/schannel.c b/lib/vtls/schannel.c
index f731eebdc5c75a6a3113505e3016e014fa38182f..63cb98a3ce468ca5c0aaf65444d781f4ca90fc17 100644 (file)
--- a/lib/vtls/schannel.c
+++ b/lib/vtls/schannel.c
@@ -213,6 +213,9 @@ schannel_connect_step1(struct connectdata *conn, int sockindex)
     case CURL_SSLVERSION_TLSv1_2:
       schannel_cred.grbitEnabledProtocols = SP_PROT_TLS1_2_CLIENT;
       break;
+    case CURL_SSLVERSION_TLSv1_3:
+      failf(data, "schannel: TLS 1.3 is not yet supported");
+      return CURLE_SSL_CONNECT_ERROR;
     case CURL_SSLVERSION_SSLv3:
       schannel_cred.grbitEnabledProtocols = SP_PROT_SSL3_CLIENT;
       break;

diff --git a/packages/OS400/curl.inc.in b/packages/OS400/curl.inc.in
index 4176905a0ccf179189120fd6759503fef40e2812..4028795ef3d6f651d03aa3732314ae50e288b615 100644 (file)
--- a/packages/OS400/curl.inc.in
+++ b/packages/OS400/curl.inc.in
@@ -258,6 +258,8 @@
      d                 c                   5
      d CURL_SSLVERSION_TLSv1_2...
      d                 c                   6
+     d CURL_SSLVERSION_TLSv1_3...
+     d                 c                   7
       *
      d CURL_TLSAUTH_NONE...
      d                 c                   0