luo980/curl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

openssl-quic: ignore ciphers for h3

Browse Source 
OpenSSL QUIC method errors on setting TLSv1.2 ciphers, where other
methods do not.

Refrain setting --ciphers when min TLS version is 1.3 or higher.
Refrain setting --tls13-ciphers when max TLS version is less than 1.3.
Add 2 test cases.

Fixes #16232
Reported-by: zzq1015 on github
Closes #16235
This commit is contained in:
Stefan Eissing 2025-02-07 11:03:18 +01:00 committed by Daniel Stenberg
parent f72b848092
commit cbf8fecda5
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
2 changed files with 28 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
lib/vtls/openssl.c
View File

@ -3670,7 +3670,7 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
ctx_option_t ctx_options = 0; ctx_option_t ctx_options = 0;
struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf); struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data); struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
const long int ssl_version_min = conn_config->version; unsigned int ssl_version_min = conn_config->version;
char * const ssl_cert = ssl_config->primary.clientcert; char * const ssl_cert = ssl_config->primary.clientcert;
const struct curl_blob *ssl_cert_blob = ssl_config->primary.cert_blob; const struct curl_blob *ssl_cert_blob = ssl_config->primary.cert_blob;
const char * const ssl_cert_type = ssl_config->cert_type; const char * const ssl_cert_type = ssl_config->cert_type;
@ -3713,6 +3713,7 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
} }
break; break;
case TRNSPRT_QUIC: case TRNSPRT_QUIC:
ssl_version_min = CURL_SSLVERSION_TLSv1_3;
if(conn_config->version_max && if(conn_config->version_max &&
(conn_config->version_max != CURL_SSLVERSION_MAX_TLSv1_3)) { (conn_config->version_max != CURL_SSLVERSION_MAX_TLSv1_3)) {
failf(data, "QUIC needs at least TLS version 1.3"); failf(data, "QUIC needs at least TLS version 1.3");
@ -3876,7 +3877,7 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
ciphers = conn_config->cipher_list; ciphers = conn_config->cipher_list;
if(!ciphers && (peer->transport != TRNSPRT_QUIC)) if(!ciphers && (peer->transport != TRNSPRT_QUIC))
ciphers = DEFAULT_CIPHER_SELECTION; ciphers = DEFAULT_CIPHER_SELECTION;
if(ciphers) { if(ciphers && (ssl_version_min < CURL_SSLVERSION_TLSv1_3)) {
if(!SSL_CTX_set_cipher_list(octx->ssl_ctx, ciphers)) { if(!SSL_CTX_set_cipher_list(octx->ssl_ctx, ciphers)) {
failf(data, "failed setting cipher list: %s", ciphers); failf(data, "failed setting cipher list: %s", ciphers);
return CURLE_SSL_CIPHER; return CURLE_SSL_CIPHER;
@ -3887,7 +3888,9 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
#ifdef HAVE_SSL_CTX_SET_CIPHERSUITES #ifdef HAVE_SSL_CTX_SET_CIPHERSUITES
{ {
const char *ciphers13 = conn_config->cipher_list13; const char *ciphers13 = conn_config->cipher_list13;
if(ciphers13) { if(ciphers13 &&
(!conn_config->version_max ||
(conn_config->version_max >= CURL_SSLVERSION_MAX_TLSv1_3))) {
if(!SSL_CTX_set_ciphersuites(octx->ssl_ctx, ciphers13)) { if(!SSL_CTX_set_ciphersuites(octx->ssl_ctx, ciphers13)) {
failf(data, "failed setting TLS 1.3 cipher suite: %s", ciphers13); failf(data, "failed setting TLS 1.3 cipher suite: %s", ciphers13);
return CURLE_SSL_CIPHER; return CURLE_SSL_CIPHER;

22
tests/http/test_17_ssl_use.py
View File

@ -424,3 +424,25 @@ class TestSSLUse:
r = curl.http_get(url=url, alpn_proto=proto, extra_args=xargs) r = curl.http_get(url=url, alpn_proto=proto, extra_args=xargs)
assert r.exit_code == 0, f'{r}' assert r.exit_code == 0, f'{r}'
assert r.json['SSL_SESSION_RESUMED'] == 'Resumed', f'{r.json}\n{r.dump_logs()}' assert r.json['SSL_SESSION_RESUMED'] == 'Resumed', f'{r.json}\n{r.dump_logs()}'
# verify the ciphers are ignored when talking TLSv1.3 only
# see issue #16232
def test_17_16_h3_ignore_ciphers12(self, env: Env):
proto = 'h3'
if proto == 'h3' and not env.have_h3():
pytest.skip("h3 not supported")
curl = CurlClient(env=env)
url = f'https://{env.authority_for(env.domain1, proto)}/curltest/sslinfo'
r = curl.http_get(url=url, alpn_proto=proto, extra_args=[
'--ciphers', 'NONSENSE'
])
assert r.exit_code == 0, f'{r}'
def test_17_17_h1_ignore_ciphers13(self, env: Env):
proto = 'http/1.1'
curl = CurlClient(env=env)
url = f'https://{env.authority_for(env.domain1, proto)}/curltest/sslinfo'
r = curl.http_get(url=url, alpn_proto=proto, extra_args=[
'--tls13-ciphers', 'NONSENSE', '--tls-max', '1.2'
])
assert r.exit_code == 0, f'{r}'