luo980/curl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

nss: map CURL_SSLVERSION_DEFAULT to NSS default

Browse Source 
... but make sure we use at least TLSv1.0 according to libcurl API

Reported-by: Cure53
Reviewed-by: Ray Satiro
This commit is contained in:
Kamil Dudka 2016-10-27 14:27:25 +02:00
parent 27302abb94
commit 5d45ced7a4
2 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
RELEASE-NOTES
View File

@ -8,6 +8,7 @@ Curl and libcurl 7.51.1
This release includes the following changes:
o nss: map CURL_SSLVERSION_DEFAULT to NSS default
o
This release includes the following bugfixes:

14
lib/vtls/nss.c
View File

@ -1489,10 +1489,18 @@ static CURLcode nss_init_sslver(SSLVersionRange *sslver,
struct Curl_easy *data)
{
switch(data->set.ssl.version) {
default:
case CURL_SSLVERSION_DEFAULT:
/* map CURL_SSLVERSION_DEFAULT to NSS default */
if(SSL_VersionRangeGetDefault(ssl_variant_stream, sslver) != SECSuccess)
return CURLE_SSL_CONNECT_ERROR;
/* ... but make sure we use at least TLSv1.0 according to libcurl API */
if(sslver->min < SSL_LIBRARY_VERSION_TLS_1_0)
sslver->min = SSL_LIBRARY_VERSION_TLS_1_0;
return CURLE_OK;
case CURL_SSLVERSION_TLSv1:
sslver->min = SSL_LIBRARY_VERSION_TLS_1_0;
/* TODO: set sslver->max to SSL_LIBRARY_VERSION_TLS_1_3 once stable */
#ifdef SSL_LIBRARY_VERSION_TLS_1_2
sslver->max = SSL_LIBRARY_VERSION_TLS_1_2;
#elif defined SSL_LIBRARY_VERSION_TLS_1_1
@ -1532,6 +1540,10 @@ static CURLcode nss_init_sslver(SSLVersionRange *sslver,
return CURLE_OK;
#endif
break;
default:
/* unsupported SSL/TLS version */
break;
}
failf(data, "TLS minor version cannot be set");