diff options
| author | Daniel Stenberg <daniel@haxx.se> | 2016-11-07 14:38:59 +0100 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2016-11-07 14:38:59 +0100 |
| commit | 9e8b0a283f52e6160626a7ad9f366fe62cc40b06 (patch) | |
| tree | 3feb02fff6eb48184cbe7fcb3c6425f097e04002 /lib | |
| parent | 50aded1cd4bb751cad52c39c4fa1f06ebc5e133e (diff) | |
openssl: initial TLS 1.3 adaptions
BoringSSL supports TLSv1.3 already, but these changes don't seem to be anough
to get it working.
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/vtls/openssl.c | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c index 24d9d42c1..edfd5356d 100644 --- a/lib/vtls/openssl.c +++ b/lib/vtls/openssl.c @@ -1549,6 +1549,11 @@ static void ssl_tls_trace(int direction, int ssl_ver, int content_type, verstr = "TLSv1.2"; break; #endif +#ifdef TLS1_3_VERSION + case TLS1_3_VERSION: + verstr = "TLSv1.3"; + break; +#endif case 0: break; default: @@ -1677,6 +1682,10 @@ get_ssl_version_txt(SSL *ssl) return ""; switch(SSL_version(ssl)) { +#ifdef TLS1_3_VERSION + case TLS1_3_VERSION: + return "TLSv1.3"; +#endif #if OPENSSL_VERSION_NUMBER >= 0x1000100FL case TLS1_2_VERSION: return "TLSv1.2"; @@ -1728,6 +1737,7 @@ static CURLcode ossl_connect_step1(struct connectdata *conn, int sockindex) case CURL_SSLVERSION_TLSv1_0: case CURL_SSLVERSION_TLSv1_1: case CURL_SSLVERSION_TLSv1_2: + case CURL_SSLVERSION_TLSv1_3: /* it will be handled later with the context options */ #if (OPENSSL_VERSION_NUMBER >= 0x10100000L) && \ !defined(LIBRESSL_VERSION_NUMBER) @@ -1891,6 +1901,16 @@ static CURLcode ossl_connect_step1(struct connectdata *conn, int sockindex) break; #endif +#ifdef TLS1_3_VERSION + case CURL_SSLVERSION_TLSv1_3: + ctx_options |= SSL_OP_NO_SSLv2; + ctx_options |= SSL_OP_NO_SSLv3; + ctx_options |= SSL_OP_NO_TLSv1; + ctx_options |= SSL_OP_NO_TLSv1_1; + ctx_options |= SSL_OP_NO_TLSv1_2; + break; +#endif + #ifndef OPENSSL_NO_SSL2 case CURL_SSLVERSION_SSLv2: ctx_options |= SSL_OP_NO_SSLv3; |