aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJay Satiro <raysatiro@yahoo.com>2018-01-10 03:14:15 -0500
committerJay Satiro <raysatiro@yahoo.com>2018-01-13 02:57:30 -0500
commit6fa10c8fa2319e0271465a796f258a239b54c35a (patch)
treea7247aad8478c81273917c151b8581785c499f6d
parent3b548ffde9f0ea85dd320ae6af23a2e3fdbb6d29 (diff)
setopt: fix SSLVERSION to allow CURL_SSLVERSION_MAX_ values
Broken since f121575 (precedes 7.56.1). Bug: https://github.com/curl/curl/issues/2225 Reported-by: cmfrolick@users.noreply.github.com Closes https://github.com/curl/curl/pull/2227
-rw-r--r--docs/libcurl/opts/CURLOPT_PROXY_SSLVERSION.312
-rw-r--r--docs/libcurl/opts/CURLOPT_SSLVERSION.314
-rw-r--r--lib/setopt.c42
3 files changed, 39 insertions, 29 deletions
diff --git a/docs/libcurl/opts/CURLOPT_PROXY_SSLVERSION.3 b/docs/libcurl/opts/CURLOPT_PROXY_SSLVERSION.3
index 6b9ff7dee..73c2c9766 100644
--- a/docs/libcurl/opts/CURLOPT_PROXY_SSLVERSION.3
+++ b/docs/libcurl/opts/CURLOPT_PROXY_SSLVERSION.3
@@ -46,10 +46,15 @@ TLSv1.1
TLSv1.2
.IP CURL_SSLVERSION_TLSv1_3
TLSv1.3
+.RE
+The maximum TLS version can be set by using \fIone\fP of the
+CURL_SSLVERSION_MAX_ macros below. It is also possible to OR \fIone\fP of the
+CURL_SSLVERSION_ macros with \fIone\fP of the CURL_SSLVERSION_MAX_ macros.
+The MAX macros are not supported for SSL backends axTLS or wolfSSL.
+.RS
.IP CURL_SSLVERSION_MAX_DEFAULT
The flag defines the maximum supported TLS version as TLSv1.2, or the default
-value from the SSL library. Only the NSS library currently allows one to get
-the maximum supported TLS version.
+value from the SSL library.
(Added in 7.54.0)
.IP CURL_SSLVERSION_MAX_TLSv1_0
The flag defines maximum supported TLS version as TLSv1.0.
@@ -75,8 +80,7 @@ if(curl) {
curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
/* ask libcurl to use TLS version 1.0 or later */
- curl_easy_setopt(curl, CURLOPT_PROXY_SSLVERSION, CURL_SSLVERSION_TLSv1_1 |
- CURL_SSLVERSION_MAX_DEFAULT);
+ curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1);
/* Perform the request */
curl_easy_perform(curl);
diff --git a/docs/libcurl/opts/CURLOPT_SSLVERSION.3 b/docs/libcurl/opts/CURLOPT_SSLVERSION.3
index 5c447d8f3..807057be5 100644
--- a/docs/libcurl/opts/CURLOPT_SSLVERSION.3
+++ b/docs/libcurl/opts/CURLOPT_SSLVERSION.3
@@ -50,10 +50,15 @@ TLSv1.1 (Added in 7.34.0)
TLSv1.2 (Added in 7.34.0)
.IP CURL_SSLVERSION_TLSv1_3
TLSv1.3 (Added in 7.52.0)
+.RE
+The maximum TLS version can be set by using \fIone\fP of the
+CURL_SSLVERSION_MAX_ macros below. It is also possible to OR \fIone\fP of the
+CURL_SSLVERSION_ macros with \fIone\fP of the CURL_SSLVERSION_MAX_ macros.
+The MAX macros are not supported for SSL backends axTLS or wolfSSL.
+.RS
.IP CURL_SSLVERSION_MAX_DEFAULT
The flag defines the maximum supported TLS version as TLSv1.2, or the default
-value from the SSL library. Only the NSS library currently allows one to get
-the maximum supported TLS version.
+value from the SSL library.
(Added in 7.54.0)
.IP CURL_SSLVERSION_MAX_TLSv1_0
The flag defines maximum supported TLS version as TLSv1.0.
@@ -78,9 +83,8 @@ CURL *curl = curl_easy_init();
if(curl) {
curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
- /* ask libcurl to use TLS version 1.1 or later */
- curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_1 |
- CURL_SSLVERSION_MAX_DEFAULT);
+ /* ask libcurl to use TLS version 1.0 or later */
+ curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1);
/* Perform the request */
curl_easy_perform(curl);
diff --git a/lib/setopt.c b/lib/setopt.c
index 60f3ae5a6..66f30ea65 100644
--- a/lib/setopt.c
+++ b/lib/setopt.c
@@ -360,32 +360,34 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option,
*/
data->set.timevalue = (time_t)va_arg(param, long);
break;
+
case CURLOPT_SSLVERSION:
- /*
- * Set explicit SSL version to try to connect with, as some SSL
- * implementations are lame.
- */
-#ifdef USE_SSL
- arg = va_arg(param, long);
- if((arg < CURL_SSLVERSION_DEFAULT) || (arg > CURL_SSLVERSION_TLSv1_3))
- return CURLE_BAD_FUNCTION_ARGUMENT;
- data->set.ssl.primary.version = C_SSLVERSION_VALUE(arg);
- data->set.ssl.primary.version_max = C_SSLVERSION_MAX_VALUE(arg);
-#else
- result = CURLE_UNKNOWN_OPTION;
-#endif
- break;
case CURLOPT_PROXY_SSLVERSION:
/*
- * Set explicit SSL version to try to connect with for proxy, as some SSL
+ * Set explicit SSL version to try to connect with, as some SSL
* implementations are lame.
*/
#ifdef USE_SSL
- arg = va_arg(param, long);
- if((arg < CURL_SSLVERSION_DEFAULT) || (arg > CURL_SSLVERSION_TLSv1_3))
- return CURLE_BAD_FUNCTION_ARGUMENT;
- data->set.proxy_ssl.primary.version = C_SSLVERSION_VALUE(arg);
- data->set.proxy_ssl.primary.version_max = C_SSLVERSION_MAX_VALUE(arg);
+ {
+ long version, version_max;
+ struct ssl_primary_config *primary = (option == CURLOPT_SSLVERSION ?
+ &data->set.ssl.primary :
+ &data->set.proxy_ssl.primary);
+
+ arg = va_arg(param, long);
+
+ version = C_SSLVERSION_VALUE(arg);
+ version_max = C_SSLVERSION_MAX_VALUE(arg);
+
+ if(version < CURL_SSLVERSION_DEFAULT ||
+ version >= CURL_SSLVERSION_LAST ||
+ version_max < CURL_SSLVERSION_MAX_NONE ||
+ version_max >= CURL_SSLVERSION_MAX_LAST)
+ return CURLE_BAD_FUNCTION_ARGUMENT;
+
+ primary->version = version;
+ primary->version_max = version_max;
+ }
#else
result = CURLE_UNKNOWN_OPTION;
#endif