sectransp: allow cipher name to be specified
—
$ git checkout -f dd2bb485521c2ec713001b3a7356555dd893e2e6
Previous HEAD position was 3057c6cd73 Revert "cmake: make libcurl library output name configurable"
HEAD is now at dd2bb48552 sectransp: allow cipher name to be specified
$ git clean -fdx
Removing Makefile
Removing Makefile.in
Removing aclocal.m4
Removing autom4te.cache/
Removing compile
Removing config.guess
Removing config.log
Removing config.status
Removing config.sub
Removing configure
Removing curl-config
Removing depcomp
Removing docs/Makefile
Removing docs/Makefile.in
Removing docs/cmdline-opts/Makefile
Removing docs/cmdline-opts/Makefile.in
Removing docs/curl.1
Removing docs/examples/.deps/
Removing docs/examples/Makefile
Removing docs/examples/Makefile.in
Removing docs/libcurl/Makefile
Removing docs/libcurl/Makefile.in
Removing docs/libcurl/opts/Makefile
Removing docs/libcurl/opts/Makefile.in
Removing include/Makefile
Removing include/Makefile.in
Removing include/curl/Makefile
Removing include/curl/Makefile.in
Removing install-sh
Removing lib/.deps/
Removing lib/.dirstamp
Removing lib/.libs/
Removing lib/Makefile
Removing lib/Makefile.in
Removing lib/curl-curl_ctype.o
Removing lib/curl-curl_multibyte.o
Removing lib/curl-dynbuf.o
Removing lib/curl-nonblock.o
Removing lib/curl-strtoofft.o
Removing lib/curl-version_win32.o
Removing lib/curl-warnless.o
Removing lib/curl_config.h
Removing lib/curl_config.h.in
Removing lib/libcurl.la
Removing lib/libcurl.vers
Removing lib/libcurl_la-altsvc.lo
Removing lib/libcurl_la-altsvc.o
Removing lib/libcurl_la-amigaos.lo
Removing lib/libcurl_la-amigaos.o
Removing lib/libcurl_la-asyn-ares.lo
Removing lib/libcurl_la-asyn-ares.o
Removing lib/libcurl_la-asyn-thread.lo
Removing lib/libcurl_la-asyn-thread.o
Removing lib/libcurl_la-base64.lo
Removing lib/libcurl_la-base64.o
Removing lib/libcurl_la-c-hyper.lo
Removing lib/libcurl_la-c-hyper.o
Removing lib/libcurl_la-conncache.lo
Removing lib/libcurl_la-conncache.o
Removing lib/libcurl_la-connect.lo
Removing lib/libcurl_la-connect.o
Removing lib/libcurl_la-content_encoding.lo
Removing lib/libcurl_la-content_encoding.o
Removing lib/libcurl_la-cookie.lo
Removing lib/libcurl_la-cookie.o
Removing lib/libcurl_la-curl_addrinfo.lo
Removing lib/libcurl_la-curl_addrinfo.o
Removing lib/libcurl_la-curl_ctype.lo
Removing lib/libcurl_la-curl_ctype.o
Removing lib/libcurl_la-curl_des.lo
Removing lib/libcurl_la-curl_des.o
Removing lib/libcurl_la-curl_endian.lo
Removing lib/libcurl_la-curl_endian.o
Removing lib/libcurl_la-curl_fnmatch.lo
Removing lib/libcurl_la-curl_fnmatch.o
Removing lib/libcurl_la-curl_get_line.lo
Removing lib/libcurl_la-curl_get_line.o
Removing lib/libcurl_la-curl_gethostname.lo
Removing lib/libcurl_la-curl_gethostname.o
Removing lib/libcurl_la-curl_gssapi.lo
Removing lib/libcurl_la-curl_gssapi.o
Removing lib/libcurl_la-curl_memrchr.lo
Removing lib/libcurl_la-curl_memrchr.o
Removing lib/libcurl_la-curl_multibyte.lo
Removing lib/libcurl_la-curl_multibyte.o
Removing lib/libcurl_la-curl_ntlm_core.lo
Removing lib/libcurl_la-curl_ntlm_core.o
Removing lib/libcurl_la-curl_ntlm_wb.lo
Removing lib/libcurl_la-curl_ntlm_wb.o
Removing lib/libcurl_la-curl_path.lo
Removing lib/libcurl_la-curl_path.o
Removing lib/libcurl_la-curl_range.lo
Removing lib/libcurl_la-curl_range.o
Removing lib/libcurl_la-curl_rtmp.lo
Removing lib/libcurl_la-curl_rtmp.o
Removing lib/libcurl_la-curl_sasl.lo
Removing lib/libcurl_la-curl_sasl.o
Removing lib/libcurl_la-curl_sspi.lo
Removing lib/libcurl_la-curl_sspi.o
Removing lib/libcurl_la-curl_threads.lo
Removing lib/libcurl_la-curl_threads.o
Removing lib/libcurl_la-dict.lo
Removing lib/libcurl_la-dict.o
Removing lib/libcurl_la-doh.lo
Removing lib/libcurl_la-doh.o
Removing lib/libcurl_la-dotdot.lo
Removing lib/libcurl_la-dotdot.o
Removing lib/libcurl_la-dynbuf.lo
Removing lib/libcurl_la-dynbuf.o
Removing lib/libcurl_la-easy.lo
Removing lib/libcurl_la-easy.o
Removing lib/libcurl_la-easygetopt.lo
Removing lib/libcurl_la-easygetopt.o
Removing lib/libcurl_la-easyoptions.lo
Removing lib/libcurl_la-easyoptions.o
Removing lib/libcurl_la-escape.lo
Removing lib/libcurl_la-escape.o
Removing lib/libcurl_la-file.lo
Removing lib/libcurl_la-file.o
Removing lib/libcurl_la-fileinfo.lo
Removing lib/libcurl_la-fileinfo.o
Removing lib/libcurl_la-formdata.lo
Removing lib/libcurl_la-formdata.o
Removing lib/libcurl_la-ftp.lo
Removing lib/libcurl_la-ftp.o
Removing lib/libcurl_la-ftplistparser.lo
Removing lib/libcurl_la-ftplistparser.o
Removing lib/libcurl_la-getenv.lo
Removing lib/libcurl_la-getenv.o
Removing lib/libcurl_la-getinfo.lo
Removing lib/libcurl_la-getinfo.o
Removing lib/libcurl_la-gopher.lo
Removing lib/libcurl_la-gopher.o
Removing lib/libcurl_la-hash.lo
Removing lib/libcurl_la-hash.o
Removing lib/libcurl_la-hmac.lo
Removing lib/libcurl_la-hmac.o
Removing lib/libcurl_la-hostasyn.lo
Removing lib/libcurl_la-hostasyn.o
Removing lib/libcurl_la-hostcheck.lo
Removing lib/libcurl_la-hostcheck.o
Removing lib/libcurl_la-hostip.lo
Removing lib/libcurl_la-hostip.o
Removing lib/libcurl_la-hostip4.lo
Removing lib/libcurl_la-hostip4.o
Removing lib/libcurl_la-hostip6.lo
Removing lib/libcurl_la-hostip6.o
Removing lib/libcurl_la-hostsyn.lo
Removing lib/libcurl_la-hostsyn.o
Removing lib/libcurl_la-hsts.lo
Removing lib/libcurl_la-hsts.o
Removing lib/libcurl_la-http.lo
Removing lib/libcurl_la-http.o
Removing lib/libcurl_la-http2.lo
Removing lib/libcurl_la-http2.o
Removing lib/libcurl_la-http_aws_sigv4.lo
Removing lib/libcurl_la-http_aws_sigv4.o
Removing lib/libcurl_la-http_chunks.lo
Removing lib/libcurl_la-http_chunks.o
Removing lib/libcurl_la-http_digest.lo
Removing lib/libcurl_la-http_digest.o
Removing lib/libcurl_la-http_negotiate.lo
Removing lib/libcurl_la-http_negotiate.o
Removing lib/libcurl_la-http_ntlm.lo
Removing lib/libcurl_la-http_ntlm.o
Removing lib/libcurl_la-http_proxy.lo
Removing lib/libcurl_la-http_proxy.o
Removing lib/libcurl_la-idn_win32.lo
Removing lib/libcurl_la-idn_win32.o
Removing lib/libcurl_la-if2ip.lo
Removing lib/libcurl_la-if2ip.o
Removing lib/libcurl_la-imap.lo
Removing lib/libcurl_la-imap.o
Removing lib/libcurl_la-inet_ntop.lo
Removing lib/libcurl_la-inet_ntop.o
Removing lib/libcurl_la-inet_pton.lo
Removing lib/libcurl_la-inet_pton.o
Removing lib/libcurl_la-krb5.lo
Removing lib/libcurl_la-krb5.o
Removing lib/libcurl_la-ldap.lo
Removing lib/libcurl_la-ldap.o
Removing lib/libcurl_la-llist.lo
Removing lib/libcurl_la-llist.o
Removing lib/libcurl_la-md4.lo
Removing lib/libcurl_la-md4.o
Removing lib/libcurl_la-md5.lo
Removing lib/libcurl_la-md5.o
Removing lib/libcurl_la-memdebug.lo
Removing lib/libcurl_la-memdebug.o
Removing lib/libcurl_la-mime.lo
Removing lib/libcurl_la-mime.o
Removing lib/libcurl_la-mprintf.lo
Removing lib/libcurl_la-mprintf.o
Removing lib/libcurl_la-mqtt.lo
Removing lib/libcurl_la-mqtt.o
Removing lib/libcurl_la-multi.lo
Removing lib/libcurl_la-multi.o
Removing lib/libcurl_la-netrc.lo
Removing lib/libcurl_la-netrc.o
Removing lib/libcurl_la-non-ascii.lo
Removing lib/libcurl_la-non-ascii.o
Removing lib/libcurl_la-nonblock.lo
Removing lib/libcurl_la-nonblock.o
Removing lib/libcurl_la-openldap.lo
Removing lib/libcurl_la-openldap.o
Removing lib/libcurl_la-parsedate.lo
Removing lib/libcurl_la-parsedate.o
Removing lib/libcurl_la-pingpong.lo
Removing lib/libcurl_la-pingpong.o
Removing lib/libcurl_la-pop3.lo
Removing lib/libcurl_la-pop3.o
Removing lib/libcurl_la-progress.lo
Removing lib/libcurl_la-progress.o
Removing lib/libcurl_la-psl.lo
Removing lib/libcurl_la-psl.o
Removing lib/libcurl_la-rand.lo
Removing lib/libcurl_la-rand.o
Removing lib/libcurl_la-rename.lo
Removing lib/libcurl_la-rename.o
Removing lib/libcurl_la-rtsp.lo
Removing lib/libcurl_la-rtsp.o
Removing lib/libcurl_la-select.lo
Removing lib/libcurl_la-select.o
Removing lib/libcurl_la-sendf.lo
Removing lib/libcurl_la-sendf.o
Removing lib/libcurl_la-setopt.lo
Removing lib/libcurl_la-setopt.o
Removing lib/libcurl_la-sha256.lo
Removing lib/libcurl_la-sha256.o
Removing lib/libcurl_la-share.lo
Removing lib/libcurl_la-share.o
Removing lib/libcurl_la-slist.lo
Removing lib/libcurl_la-slist.o
Removing lib/libcurl_la-smb.lo
Removing lib/libcurl_la-smb.o
Removing lib/libcurl_la-smtp.lo
Removing lib/libcurl_la-smtp.o
Removing lib/libcurl_la-socketpair.lo
Removing lib/libcurl_la-socketpair.o
Removing lib/libcurl_la-socks.lo
Removing lib/libcurl_la-socks.o
Removing lib/libcurl_la-socks_gssapi.lo
Removing lib/libcurl_la-socks_gssapi.o
Removing lib/libcurl_la-socks_sspi.lo
Removing lib/libcurl_la-socks_sspi.o
Removing lib/libcurl_la-speedcheck.lo
Removing lib/libcurl_la-speedcheck.o
Removing lib/libcurl_la-splay.lo
Removing lib/libcurl_la-splay.o
Removing lib/libcurl_la-strcase.lo
Removing lib/libcurl_la-strcase.o
Removing lib/libcurl_la-strdup.lo
Removing lib/libcurl_la-strdup.o
Removing lib/libcurl_la-strerror.lo
Removing lib/libcurl_la-strerror.o
Removing lib/libcurl_la-strtok.lo
Removing lib/libcurl_la-strtok.o
Removing lib/libcurl_la-strtoofft.lo
Removing lib/libcurl_la-strtoofft.o
Removing lib/libcurl_la-system_win32.lo
Removing lib/libcurl_la-system_win32.o
Removing lib/libcurl_la-telnet.lo
Removing lib/libcurl_la-telnet.o
Removing lib/libcurl_la-tftp.lo
Removing lib/libcurl_la-tftp.o
Removing lib/libcurl_la-timeval.lo
Removing lib/libcurl_la-timeval.o
Removing lib/libcurl_la-transfer.lo
Removing lib/libcurl_la-transfer.o
Removing lib/libcurl_la-url.lo
Removing lib/libcurl_la-url.o
Removing lib/libcurl_la-urlapi.lo
Removing lib/libcurl_la-urlapi.o
Removing lib/libcurl_la-version.lo
Removing lib/libcurl_la-version.o
Removing lib/libcurl_la-version_win32.lo
Removing lib/libcurl_la-version_win32.o
Removing lib/libcurl_la-warnless.lo
Removing lib/libcurl_la-warnless.o
Removing lib/libcurl_la-wildcard.lo
Removing lib/libcurl_la-wildcard.o
Removing lib/libcurl_la-x509asn1.lo
Removing lib/libcurl_la-x509asn1.o
Removing lib/stamp-h1
Removing lib/vauth/.deps/
Removing lib/vauth/.dirstamp
Removing lib/vauth/libcurl_la-cleartext.lo
Removing lib/vauth/libcurl_la-cleartext.o
Removing lib/vauth/libcurl_la-cram.lo
Removing lib/vauth/libcurl_la-cram.o
Removing lib/vauth/libcurl_la-digest.lo
Removing lib/vauth/libcurl_la-digest.o
Removing lib/vauth/libcurl_la-digest_sspi.lo
Removing lib/vauth/libcurl_la-digest_sspi.o
Removing lib/vauth/libcurl_la-gsasl.lo
Removing lib/vauth/libcurl_la-gsasl.o
Removing lib/vauth/libcurl_la-krb5_gssapi.lo
Removing lib/vauth/libcurl_la-krb5_gssapi.o
Removing lib/vauth/libcurl_la-krb5_sspi.lo
Removing lib/vauth/libcurl_la-krb5_sspi.o
Removing lib/vauth/libcurl_la-ntlm.lo
Removing lib/vauth/libcurl_la-ntlm.o
Removing lib/vauth/libcurl_la-ntlm_sspi.lo
Removing lib/vauth/libcurl_la-ntlm_sspi.o
Removing lib/vauth/libcurl_la-oauth2.lo
Removing lib/vauth/libcurl_la-oauth2.o
Removing lib/vauth/libcurl_la-spnego_gssapi.lo
Removing lib/vauth/libcurl_la-spnego_gssapi.o
Removing lib/vauth/libcurl_la-spnego_sspi.lo
Removing lib/vauth/libcurl_la-spnego_sspi.o
Removing lib/vauth/libcurl_la-vauth.lo
Removing lib/vauth/libcurl_la-vauth.o
Removing lib/vquic/.deps/
Removing lib/vquic/.dirstamp
Removing lib/vquic/libcurl_la-ngtcp2.lo
Removing lib/vquic/libcurl_la-ngtcp2.o
Removing lib/vquic/libcurl_la-quiche.lo
Removing lib/vquic/libcurl_la-quiche.o
Removing lib/vquic/libcurl_la-vquic.lo
Removing lib/vquic/libcurl_la-vquic.o
Removing lib/vssh/.deps/
Removing lib/vssh/.dirstamp
Removing lib/vssh/libcurl_la-libssh.lo
Removing lib/vssh/libcurl_la-libssh.o
Removing lib/vssh/libcurl_la-libssh2.lo
Removing lib/vssh/libcurl_la-libssh2.o
Removing lib/vssh/libcurl_la-wolfssh.lo
Removing lib/vssh/libcurl_la-wolfssh.o
Removing lib/vtls/.deps/
Removing lib/vtls/.dirstamp
Removing lib/vtls/libcurl_la-bearssl.lo
Removing lib/vtls/libcurl_la-bearssl.o
Removing lib/vtls/libcurl_la-gskit.lo
Removing lib/vtls/libcurl_la-gskit.o
Removing lib/vtls/libcurl_la-gtls.lo
Removing lib/vtls/libcurl_la-gtls.o
Removing lib/vtls/libcurl_la-keylog.lo
Removing lib/vtls/libcurl_la-keylog.o
Removing lib/vtls/libcurl_la-mbedtls.lo
Removing lib/vtls/libcurl_la-mbedtls.o
Removing lib/vtls/libcurl_la-mbedtls_threadlock.lo
Removing lib/vtls/libcurl_la-mbedtls_threadlock.o
Removing lib/vtls/libcurl_la-mesalink.lo
Removing lib/vtls/libcurl_la-mesalink.o
Removing lib/vtls/libcurl_la-nss.lo
Removing lib/vtls/libcurl_la-nss.o
Removing lib/vtls/libcurl_la-openssl.lo
Removing lib/vtls/libcurl_la-openssl.o
Removing lib/vtls/libcurl_la-rustls.lo
Removing lib/vtls/libcurl_la-rustls.o
Removing lib/vtls/libcurl_la-schannel.lo
Removing lib/vtls/libcurl_la-schannel.o
Removing lib/vtls/libcurl_la-schannel_verify.lo
Removing lib/vtls/libcurl_la-schannel_verify.o
Removing lib/vtls/libcurl_la-sectransp.lo
Removing lib/vtls/libcurl_la-sectransp.o
Removing lib/vtls/libcurl_la-vtls.lo
Removing lib/vtls/libcurl_la-vtls.o
Removing lib/vtls/libcurl_la-wolfssl.lo
Removing lib/vtls/libcurl_la-wolfssl.o
Removing libcurl.pc
Removing libtool
Removing ltmain.sh
Removing m4/libtool.m4
Removing m4/ltoptions.m4
Removing m4/ltsugar.m4
Removing m4/ltversion.m4
Removing m4/lt~obsolete.m4
Removing missing
Removing packages/Makefile
Removing packages/Makefile.in
Removing packages/vms/Makefile
Removing packages/vms/Makefile.in
Removing scripts/Makefile
Removing scripts/Makefile.in
Removing src/.deps/
Removing src/.libs/
Removing src/Makefile
Removing src/Makefile.in
Removing src/curl
Removing src/curl-slist_wc.o
Removing src/curl-tool_binmode.o
Removing src/curl-tool_bname.o
Removing src/curl-tool_cb_dbg.o
Removing src/curl-tool_cb_hdr.o
Removing src/curl-tool_cb_prg.o
Removing src/curl-tool_cb_rea.o
Removing src/curl-tool_cb_see.o
Removing src/curl-tool_cb_wrt.o
Removing src/curl-tool_cfgable.o
Removing src/curl-tool_convert.o
Removing src/curl-tool_dirhie.o
Removing src/curl-tool_doswin.o
Removing src/curl-tool_easysrc.o
Removing src/curl-tool_filetime.o
Removing src/curl-tool_formparse.o
Removing src/curl-tool_getparam.o
Removing src/curl-tool_getpass.o
Removing src/curl-tool_help.o
Removing src/curl-tool_helpers.o
Removing src/curl-tool_homedir.o
Removing src/curl-tool_hugehelp.o
Removing src/curl-tool_libinfo.o
Removing src/curl-tool_main.o
Removing src/curl-tool_metalink.o
Removing src/curl-tool_msgs.o
Removing src/curl-tool_operate.o
Removing src/curl-tool_operhlp.o
Removing src/curl-tool_panykey.o
Removing src/curl-tool_paramhlp.o
Removing src/curl-tool_parsecfg.o
Removing src/curl-tool_progress.o
Removing src/curl-tool_setopt.o
Removing src/curl-tool_sleep.o
Removing src/curl-tool_strdup.o
Removing src/curl-tool_urlglob.o
Removing src/curl-tool_util.o
Removing src/curl-tool_vms.o
Removing src/curl-tool_writeout.o
Removing src/curl-tool_writeout_json.o
Removing src/curl-tool_xattr.o
Removing src/tool_hugehelp.c
Removing test-driver
Removing tests/Makefile
Removing tests/Makefile.in
Removing tests/certs/Makefile
Removing tests/certs/Makefile.in
Removing tests/certs/scripts/Makefile
Removing tests/certs/scripts/Makefile.in
Removing tests/configurehelp.pm
Removing tests/data/Makefile
Removing tests/data/Makefile.in
Removing tests/libtest/.deps/
Removing tests/libtest/Makefile
Removing tests/libtest/Makefile.in
Removing tests/server/.deps/
Removing tests/server/Makefile
Removing tests/server/Makefile.in
Removing tests/unit/.deps/
Removing tests/unit/Makefile
Removing tests/unit/Makefile.in
$ autoreconf -fi
libtoolize: putting auxiliary files in '.'.
libtoolize: copying file './ltmain.sh'
libtoolize: putting macros in AC_CONFIG_MACRO_DIRS, 'm4'.
libtoolize: copying file 'm4/libtool.m4'
libtoolize: copying file 'm4/ltoptions.m4'
libtoolize: copying file 'm4/ltsugar.m4'
libtoolize: copying file 'm4/ltversion.m4'
libtoolize: copying file 'm4/lt~obsolete.m4'
libtoolize: Remember to add 'LT_INIT' to configure.ac.
configure.ac:120: installing './compile'
configure.ac:188: installing './config.guess'
configure.ac:188: installing './config.sub'
configure.ac:120: installing './install-sh'
configure.ac:125: installing './missing'
docs/examples/Makefile.am: installing './depcomp'
parallel-tests: installing './test-driver'
$ bash -c find . -name config.guess -exec cp /usr/share/misc/config.guess {} \;
$ bash -c find . -name config.sub -exec cp /usr/share/misc/config.sub {} \;
$ chmod +x configure
$ ./configure --disable-shared --without-ssl --disable-docs
checking whether to enable maintainer-specific portions of Makefiles... no
checking whether make supports nested variables... yes
checking whether to enable debug build options... no
checking whether to enable compiler optimizer... (assumed) yes
checking whether to enable strict compiler warnings... no
checking whether to enable compiler warnings as errors... no
checking whether to enable curl debug memory tracking... no
checking whether to enable hiding of library internal symbols... yes
checking whether to enable c-ares for DNS lookups... no
checking whether to disable dependency on -lrt... (assumed no)
checking whether to enable ECH support... no
checking for path separator... :
checking for sed... /usr/bin/sed
checking for grep... /usr/bin/grep
checking for egrep... /usr/bin/grep -E
checking for ar... /usr/bin/ar
checking for a BSD-compatible install... /usr/bin/install -c
checking for gcc... ccache gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables...
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether the compiler supports GNU C... yes
checking whether ccache gcc accepts -g... yes
checking for ccache gcc option to enable C11 features... none needed
checking whether ccache gcc understands -c and -o together... yes
checking how to run the C preprocessor... ccache gcc -E
checking for a sed that does not truncate output... (cached) /usr/bin/sed
checking for code coverage support... no
checking whether build environment is sane... yes
checking for a race-free mkdir -p... /usr/bin/mkdir -p
checking for gawk... gawk
checking whether make sets $(MAKE)... yes
checking whether make supports the include directive... yes (GNU style)
checking dependency style of ccache gcc... gcc3
checking curl version... 7.77.0-DEV
checking build system type... x86_64-pc-linux-gnu
checking host system type... x86_64-pc-linux-gnu
checking for grep that handles long lines and -e... (cached) /usr/bin/grep
checking for egrep... /usr/bin/grep -E
checking if OS is AIX (to define _ALL_SOURCE)... no
checking if _THREAD_SAFE is already defined... no
checking if _THREAD_SAFE is actually needed... no
checking if _THREAD_SAFE is onwards defined... no
checking if _REENTRANT is already defined... no
checking if _REENTRANT is actually needed... no
checking if _REENTRANT is onwards defined... no
checking for special C compiler options needed for large files... no
checking for _FILE_OFFSET_BITS value needed for large files... no
checking how to print strings... printf
checking for a sed that does not truncate output... (cached) /usr/bin/sed
checking for fgrep... /usr/bin/grep -F
checking for ld used by ccache gcc... /usr/bin/ld
checking if the linker (/usr/bin/ld) is GNU ld... yes
checking for BSD- or MS-compatible name lister (nm)... /usr/bin/nm -B
checking the name lister (/usr/bin/nm -B) interface... BSD nm
checking whether ln -s works... yes
checking the maximum length of command line arguments... 1572864
checking how to convert x86_64-pc-linux-gnu file names to x86_64-pc-linux-gnu format... func_convert_file_noop
checking how to convert x86_64-pc-linux-gnu file names to toolchain format... func_convert_file_noop
checking for /usr/bin/ld option to reload object files... -r
checking for objdump... objdump
checking how to recognize dependent libraries... pass_all
checking for dlltool... no
checking how to associate runtime and link libraries... printf %s\n
checking for archiver @FILE support... @
checking for strip... strip
checking for ranlib... ranlib
checking command to parse /usr/bin/nm -B output from ccache gcc object... ok
checking for sysroot... no
checking for a working dd... /usr/bin/dd
checking how to truncate binary pipes... /usr/bin/dd bs=4096 count=1
checking for mt... mt
checking if mt is a manifest tool... no
checking for stdio.h... yes
checking for stdlib.h... yes
checking for string.h... yes
checking for inttypes.h... yes
checking for stdint.h... yes
checking for strings.h... yes
checking for sys/stat.h... yes
checking for sys/types.h... yes
checking for unistd.h... yes
checking for dlfcn.h... yes
checking for objdir... .libs
checking if ccache gcc supports -fno-rtti -fno-exceptions... no
checking for ccache gcc option to produce PIC... -fPIC -DPIC
checking if ccache gcc PIC flag -fPIC -DPIC works... yes
checking if ccache gcc static flag -static works... yes
checking if ccache gcc supports -c -o file.o... yes
checking if ccache gcc supports -c -o file.o... (cached) yes
checking whether the ccache gcc linker (/usr/bin/ld -m elf_x86_64) supports shared libraries... yes
checking dynamic linker characteristics... GNU/Linux ld.so
checking how to hardcode library paths into programs... immediate
checking whether stripping libraries is possible... yes
checking if libtool supports shared libraries... yes
checking whether to build shared libraries... no
checking whether to build static libraries... yes
checking whether to build shared libraries with -version-info... yes
checking whether to build shared libraries with -no-undefined... no
checking whether to build shared libraries with -mimpure-text... no
checking whether to build shared libraries with PIC... yes
checking whether to build static libraries with PIC... yes
checking whether to build shared libraries only... no
checking whether to build static libraries only... yes
checking for inline... inline
checking if cpp -P is needed... yes
checking if cpp -P works... yes
checking if compiler is DEC/Compaq/HP C... no
checking if compiler is HP-UX C... no
checking if compiler is IBM C... no
checking if compiler is Intel C... no
checking if compiler is clang... no
checking if compiler is GNU C... yes
checking if compiler is LCC... no
checking if compiler is SGI MIPSpro C... no
checking if compiler is SGI MIPS C... no
checking if compiler is SunPro C... no
checking if compiler is Tiny C... no
checking if compiler is Watcom C... no
checking if compiler accepts some basic options... yes
configure: compiler options added: -Werror-implicit-function-declaration
checking if compiler accepts debug disabling options... yes
configure: compiler options added:
checking if compiler optimizer assumed setting might be used... yes
checking if compiler accepts optimizer enabling options... yes
configure: compiler options added: -O2
checking if compiler accepts strict warning options... yes
configure: compiler options added: -Wno-system-headers -Wenum-conversion
checking if compiler halts on compilation errors... yes
checking if compiler halts on negative sized arrays... yes
checking if compiler halts on function prototype mismatch... yes
checking if compiler supports hiding library internal symbols... yes
checking for windows.h... no
checking whether build target is a native Windows one... no
checking whether build target supports WIN32 file API... no
checking whether build target supports WIN32 crypto API... no
checking for good-to-use Darwin CFLAGS... no
checking to see if the compiler supports __builtin_available()... no
checking whether to support http... yes
checking whether to support ftp... yes
checking whether to support file... yes
checking whether to support ldap... yes
checking whether to support ldaps... yes
checking whether to support rtsp... yes
checking whether to support proxies... yes
checking whether to support dict... yes
checking whether to support telnet... yes
checking whether to support tftp... yes
checking whether to support pop3... yes
checking whether to support imap... yes
checking whether to support smb... yes
checking whether to support smtp... yes
checking whether to support gopher... yes
checking whether to support mqtt... no
checking whether to provide built-in manual... yes
checking whether to enable generation of C code... yes
checking whether to use libgcc... no
checking if X/Open network library is required... no
checking for gethostbyname... yes
checking for windows.h... (cached) no
checking for winsock.h... (cached) no
checking for winsock2.h... (cached) no
checking for proto/bsdsocket.h... no
checking for connect in libraries... yes
checking for sys/types.h... (cached) yes
checking for sys/time.h... yes
checking for monotonic clock_gettime... yes
checking for clock_gettime in libraries... no additional lib required
checking if monotonic clock_gettime works... yes
checking for pkg-config... /usr/bin/pkg-config
checking for zlib options with pkg-config... found
checking for zlib.h... yes
configure: found both libz and libz.h header
checking for BrotliDecoderDecompress in -lbrotlidec... no
checking for brotli/decode.h... no
checking for ZSTD_createDStream in -lzstd... no
checking for zstd.h... no
checking for lber.h... no
checking for ldap.h... no
checking for ldapssl.h... no
checking for ldap_ssl.h... no
checking for LDAP libraries... cannot find LDAP libraries
checking whether to enable IPv6... yes
checking if struct sockaddr_in6 has sin6_scope_id member... yes
checking if argv can be written to... yes
checking if GSS-API support is requested... no
checking whether to enable Windows native SSL/TLS (Windows native builds only)... no
checking whether to enable Secure Transport... no
checking whether to enable Amiga native SSL/TLS (AmiSSL)... no
checking for library containing psl_builtin... -lpsl
checking for library containing gsasl_init... no
checking for RTMP_Init in -lrtmp... no
checking whether versioned symbols are wanted... no
checking whether to enable Windows native IDN (Windows native builds only)... no
checking whether to build with libidn2... (assumed) yes
checking for pkg-config... (cached) /usr/bin/pkg-config
checking for libidn2 options with pkg-config... no
configure: IDN_LIBS: "-lidn2"
configure: IDN_LDFLAGS: ""
configure: IDN_CPPFLAGS: ""
configure: IDN_DIR: ""
checking if idn2_lookup_ul can be linked... no
checking for idn2.h... no
checking for pkg-config... (cached) /usr/bin/pkg-config
checking for libnghttp2 options with pkg-config... no
checking for pkg-config... (cached) /usr/bin/pkg-config
checking for libngtcp2 options with pkg-config... no
checking for pkg-config... (cached) /usr/bin/pkg-config
checking for fish options with pkg-config... no
checking for malloc.h... yes
checking for memory.h... no
checking for sys/types.h... (cached) yes
checking for sys/time.h... (cached) yes
checking for sys/select.h... yes
checking for sys/socket.h... yes
checking for sys/ioctl.h... yes
checking for sys/uio.h... yes
checking for assert.h... yes
checking for unistd.h... (cached) yes
checking for stdlib.h... (cached) yes
checking for arpa/inet.h... yes
checking for net/if.h... yes
checking for netinet/in.h... yes
checking for netinet/in6.h... no
checking for sys/un.h... yes
checking for linux/tcp.h... yes
checking for netinet/tcp.h... yes
checking for netdb.h... yes
checking for sys/sockio.h... no
checking for sys/stat.h... (cached) yes
checking for sys/param.h... yes
checking for termios.h... yes
checking for termio.h... yes
checking for sgtty.h... yes
checking for fcntl.h... yes
checking for alloca.h... yes
checking for io.h... no
checking for pwd.h... yes
checking for utime.h... yes
checking for sys/utime.h... no
checking for sys/poll.h... yes
checking for poll.h... yes
checking for socket.h... no
checking for sys/resource.h... yes
checking for libgen.h... yes
checking for locale.h... yes
checking for errno.h... yes
checking for stdbool.h... yes
checking for arpa/tftp.h... yes
checking for sys/filio.h... no
checking for sys/wait.h... yes
checking for setjmp.h... yes
checking for an ANSI C-conforming const... yes
checking for compiler support of C99 variadic macro style... yes
checking for compiler support of old gcc variadic macro style... yes
checking for size_t... yes
checking for sys/types.h... (cached) yes
checking for sys/time.h... (cached) yes
checking for sys/socket.h... (cached) yes
checking for struct timeval... yes
checking run-time libs availability... fine
checking size of size_t... 8
checking size of long... 8
checking size of int... 4
checking size of short... 2
checking size of time_t... 8
checking size of off_t... 8
checking size of curl_off_t... 8
checking for long long... yes
checking if numberLL works... yes
checking for ssize_t... yes
checking for bool... yes
checking for sa_family_t... yes
checking for suseconds_t... yes
checking if time_t is unsigned... no
checking for sys/types.h... (cached) yes
checking for poll.h... (cached) yes
checking for sys/poll.h... (cached) yes
checking for in_addr_t... yes
checking for struct sockaddr_storage... yes
checking for signal.h... yes
checking for sig_atomic_t... yes
checking if sig_atomic_t is already defined as volatile... no
checking for sys/select.h... (cached) yes
checking for sys/socket.h... (cached) yes
checking for select... yes
checking types of args and return type for select... int,fd_set *,struct timeval *,int
checking for sys/types.h... (cached) yes
checking for sys/socket.h... (cached) yes
checking for recv... yes
checking types of args and return type for recv... int,void *,size_t,int,ssize_t
checking for sys/types.h... (cached) yes
checking for sys/socket.h... (cached) yes
checking for send... yes
checking types of args and return type for send... int,const void *,size_t,int,ssize_t
checking for sys/types.h... (cached) yes
checking for sys/socket.h... (cached) yes
checking for MSG_NOSIGNAL... yes
checking for sys/types.h... (cached) yes
checking for unistd.h... (cached) yes
checking if alarm can be linked... yes
checking if alarm is prototyped... yes
checking if alarm is compilable... yes
checking if alarm usage allowed... yes
checking if alarm might be used... yes
checking for sys/types.h... (cached) yes
checking for string.h... (cached) yes
checking for strings.h... (cached) yes
checking for sys/types.h... (cached) yes
checking for libgen.h... (cached) yes
checking if basename can be linked... yes
checking if basename is prototyped... yes
checking if basename is compilable... yes
checking if basename usage allowed... yes
checking if basename might be used... yes
checking for sys/types.h... (cached) yes
checking for socket.h... (cached) no
checking if closesocket can be linked... no
checking if closesocket might be used... no
checking for sys/types.h... (cached) yes
checking for sys/socket.h... (cached) yes
checking if CloseSocket can be linked... no
checking if CloseSocket might be used... no
checking if connect can be linked... yes
checking if connect is prototyped... yes
checking if connect is compilable... yes
checking if connect usage allowed... yes
checking if connect might be used... yes
checking for sys/types.h... (cached) yes
checking for unistd.h... (cached) yes
checking for fcntl.h... (cached) yes
checking if fcntl can be linked... yes
checking if fcntl is prototyped... yes
checking if fcntl is compilable... yes
checking if fcntl usage allowed... yes
checking if fcntl might be used... yes
checking if fcntl O_NONBLOCK is compilable... yes
checking if fcntl O_NONBLOCK usage allowed... yes
checking if fcntl O_NONBLOCK might be used... yes
checking for windows.h... (cached) no
checking for winsock2.h... (cached) no
checking for ws2tcpip.h... (cached) no
checking for sys/types.h... (cached) yes
checking for netdb.h... (cached) yes
checking if freeaddrinfo can be linked... yes
checking if freeaddrinfo is prototyped... yes
checking if freeaddrinfo is compilable... yes
checking if freeaddrinfo usage allowed... yes
checking if freeaddrinfo might be used... yes
checking for sys/types.h... (cached) yes
checking for sys/socket.h... (cached) yes
checking for netinet/in.h... (cached) yes
checking for ifaddrs.h... yes
checking if freeifaddrs can be linked... yes
checking if freeifaddrs is prototyped... yes
checking if freeifaddrs is compilable... yes
checking if freeifaddrs usage allowed... yes
checking if freeifaddrs might be used... yes
checking for sys/types.h... (cached) yes
checking for sys/xattr.h... yes
checking if fsetxattr can be linked... yes
checking if fsetxattr is prototyped... yes
checking if fsetxattr takes 5 args.... yes
checking if fsetxattr is compilable... yes
checking if fsetxattr usage allowed... yes
checking if fsetxattr might be used... yes
checking if ftruncate can be linked... yes
checking if ftruncate is prototyped... yes
checking if ftruncate is compilable... yes
checking if ftruncate usage allowed... yes
checking if ftruncate might be used... yes
checking for sys/types.h... (cached) yes
checking for stdlib.h... (cached) yes
checking if getaddrinfo can be linked... yes
checking if getaddrinfo is prototyped... yes
checking if getaddrinfo is compilable... yes
checking if getaddrinfo seems to work... yes
checking if getaddrinfo usage allowed... yes
checking if getaddrinfo might be used... yes
checking if getaddrinfo is threadsafe... yes
checking if gai_strerror can be linked... yes
checking if gai_strerror is prototyped... yes
checking if gai_strerror is compilable... yes
checking if gai_strerror usage allowed... yes
checking if gai_strerror might be used... yes
checking if gethostbyaddr can be linked... yes
checking if gethostbyaddr is prototyped... yes
checking if gethostbyaddr is compilable... yes
checking if gethostbyaddr usage allowed... yes
checking if gethostbyaddr might be used... yes
checking if gethostbyaddr_r can be linked... yes
checking if gethostbyaddr_r is prototyped... yes
checking if gethostbyaddr_r takes 5 args.... no
checking if gethostbyaddr_r takes 7 args.... no
checking if gethostbyaddr_r takes 8 args.... yes
checking if gethostbyaddr_r is compilable... yes
checking if gethostbyaddr_r usage allowed... yes
checking if gethostbyaddr_r might be used... yes
checking if gethostbyname can be linked... yes
checking if gethostbyname is prototyped... yes
checking if gethostbyname is compilable... yes
checking if gethostbyname usage allowed... yes
checking if gethostbyname might be used... yes
checking if gethostbyname_r can be linked... yes
checking if gethostbyname_r is prototyped... yes
checking if gethostbyname_r takes 3 args.... no
checking if gethostbyname_r takes 5 args.... no
checking if gethostbyname_r takes 6 args.... yes
checking if gethostbyname_r is compilable... yes
checking if gethostbyname_r usage allowed... yes
checking if gethostbyname_r might be used... yes
checking if gethostname can be linked... yes
checking if gethostname is prototyped... yes
checking if gethostname is compilable... yes
checking for gethostname arg 2 data type... size_t
checking if gethostname usage allowed... yes
checking if gethostname might be used... yes
checking if getpeername can be linked... yes
checking if getpeername is prototyped... yes
checking if getpeername is compilable... yes
checking if getpeername usage allowed... yes
checking if getpeername might be used... yes
checking if getsockname can be linked... yes
checking if getsockname is prototyped... yes
checking if getsockname is compilable... yes
checking if getsockname usage allowed... yes
checking if getsockname might be used... yes
checking for net/if.h... (cached) yes
checking if if_nametoindex can be linked... yes
checking if if_nametoindex is prototyped... yes
checking if if_nametoindex is compilable... yes
checking if if_nametoindex usage allowed... yes
checking if if_nametoindex might be used... yes
checking if getifaddrs can be linked... yes
checking if getifaddrs is prototyped... yes
checking if getifaddrs is compilable... yes
checking if getifaddrs seems to work... yes
checking if getifaddrs usage allowed... yes
checking if getifaddrs might be used... yes
checking if getservbyport_r can be linked... yes
checking if getservbyport_r is prototyped... yes
checking if getservbyport_r takes 4 args.... no
checking if getservbyport_r takes 5 args.... no
checking if getservbyport_r takes 6 args.... yes
checking if getservbyport_r is compilable... yes
checking if getservbyport_r usage allowed... yes
checking if getservbyport_r might be used... yes
checking for sys/types.h... (cached) yes
checking for sys/time.h... (cached) yes
checking if gmtime_r can be linked... yes
checking if gmtime_r is prototyped... yes
checking if gmtime_r is compilable... yes
checking if gmtime_r seems to work... yes
checking if gmtime_r usage allowed... yes
checking if gmtime_r might be used... yes
checking for sys/types.h... (cached) yes
checking for sys/socket.h... (cached) yes
checking for netinet/in.h... (cached) yes
checking for arpa/inet.h... (cached) yes
checking if inet_ntoa_r can be linked... no
checking if inet_ntoa_r might be used... no
checking if inet_ntop can be linked... yes
checking if inet_ntop is prototyped... yes
checking if inet_ntop is compilable... yes
checking if inet_ntop seems to work... yes
checking if inet_ntop usage allowed... yes
checking if inet_ntop might be used... yes
checking if inet_pton can be linked... yes
checking if inet_pton is prototyped... yes
checking if inet_pton is compilable... yes
checking if inet_pton seems to work... yes
checking if inet_pton usage allowed... yes
checking if inet_pton might be used... yes
checking for sys/types.h... (cached) yes
checking for unistd.h... (cached) yes
checking for sys/socket.h... (cached) yes
checking for sys/ioctl.h... (cached) yes
checking for stropts.h... no
checking if ioctl can be linked... yes
checking if ioctl is prototyped... yes
checking if ioctl is compilable... yes
checking if ioctl usage allowed... yes
checking if ioctl might be used... yes
checking if ioctl FIONBIO is compilable... yes
checking if ioctl FIONBIO usage allowed... yes
checking if ioctl FIONBIO might be used... yes
checking if ioctl SIOCGIFADDR is compilable... yes
checking if ioctl SIOCGIFADDR usage allowed... yes
checking if ioctl SIOCGIFADDR might be used... yes
checking if ioctlsocket can be linked... no
checking if ioctlsocket might be used... no
checking if IoctlSocket can be linked... no
checking if IoctlSocket might be used... no
checking if localtime_r can be linked... yes
checking if localtime_r is prototyped... yes
checking if localtime_r is compilable... yes
checking if localtime_r seems to work... yes
checking if localtime_r usage allowed... yes
checking if localtime_r might be used... yes
checking if memrchr can be linked... yes
checking if memrchr is prototyped... no
checking if memrchr might be used... no
checking if poll can be linked... yes
checking if poll is prototyped... yes
checking if poll is compilable... yes
checking if poll seems to work... yes
checking if poll usage allowed... yes
checking if poll might be used... yes
checking if setsockopt can be linked... yes
checking if setsockopt is prototyped... yes
checking if setsockopt is compilable... yes
checking if setsockopt usage allowed... yes
checking if setsockopt might be used... yes
checking if setsockopt SO_NONBLOCK is compilable... no
checking if setsockopt SO_NONBLOCK might be used... no
checking for sys/types.h... (cached) yes
checking for signal.h... (cached) yes
checking if sigaction can be linked... yes
checking if sigaction is prototyped... yes
checking if sigaction is compilable... yes
checking if sigaction usage allowed... yes
checking if sigaction might be used... yes
checking if siginterrupt can be linked... yes
checking if siginterrupt is prototyped... yes
checking if siginterrupt is compilable... yes
checking if siginterrupt usage allowed... yes
checking if siginterrupt might be used... yes
checking if signal can be linked... yes
checking if signal is prototyped... yes
checking if signal is compilable... yes
checking if signal usage allowed... yes
checking if signal might be used... yes
checking for sys/types.h... (cached) yes
checking for setjmp.h... (cached) yes
checking if sigsetjmp can be linked... no
checking if sigsetjmp seems a macro... yes
checking if sigsetjmp is compilable... yes
checking if sigsetjmp usage allowed... yes
checking if sigsetjmp might be used... yes
checking if socket can be linked... yes
checking if socket is prototyped... yes
checking if socket is compilable... yes
checking if socket usage allowed... yes
checking if socket might be used... yes
checking if socketpair can be linked... yes
checking if socketpair is prototyped... yes
checking if socketpair is compilable... yes
checking if socketpair usage allowed... yes
checking if socketpair might be used... yes
checking if strcasecmp can be linked... yes
checking if strcasecmp is prototyped... yes
checking if strcasecmp is compilable... yes
checking if strcasecmp usage allowed... yes
checking if strcasecmp might be used... yes
checking if strcmpi can be linked... no
checking if strcmpi might be used... no
checking if strdup can be linked... yes
checking if strdup is prototyped... yes
checking if strdup is compilable... yes
checking if strdup usage allowed... yes
checking if strdup might be used... yes
checking if strerror_r can be linked... yes
checking if strerror_r is prototyped... yes
checking if strerror_r is compilable... yes
checking if strerror_r is glibc like... no
checking if strerror_r is POSIX like... yes
checking if strerror_r seems to work... yes
checking if strerror_r usage allowed... yes
checking if strerror_r might be used... yes
checking if stricmp can be linked... no
checking if stricmp might be used... no
checking if strncmpi can be linked... no
checking if strncmpi might be used... no
checking if strnicmp can be linked... no
checking if strnicmp might be used... no
checking if strstr can be linked... yes
checking if strstr is prototyped... yes
checking if strstr is compilable... yes
checking if strstr usage allowed... yes
checking if strstr might be used... yes
checking if strtok_r can be linked... yes
checking if strtok_r is prototyped... yes
checking if strtok_r is compilable... yes
checking if strtok_r usage allowed... yes
checking if strtok_r might be used... yes
checking if strtoll can be linked... yes
checking if strtoll is prototyped... yes
checking if strtoll is compilable... yes
checking if strtoll usage allowed... yes
checking if strtoll might be used... yes
checking for sys/types.h... (cached) yes
checking for sys/uio.h... (cached) yes
checking if writev can be linked... yes
checking if writev is prototyped... yes
checking if writev is compilable... yes
checking if writev usage allowed... yes
checking if writev might be used... yes
checking for ccache gcc options needed to detect all undeclared functions... none needed
checking whether getpwuid_r is declared... yes
checking for fnmatch... yes
checking for geteuid... yes
checking for getpass_r... no
checking deeper for getpass_r... but still no
checking for getppid... yes
checking for getpwuid... yes
checking for getpwuid_r... yes
checking for getrlimit... yes
checking for gettimeofday... yes
checking for if_nametoindex... yes
checking for mach_absolute_time... no
checking deeper for mach_absolute_time... but still no
checking for pipe... yes
checking for setlocale... yes
checking for setmode... no
checking deeper for setmode... but still no
checking for setrlimit... yes
checking for usleep... yes
checking for utime... yes
checking for utimes... yes
checking how to set a socket into non-blocking mode... fcntl O_NONBLOCK
checking for perl... /usr/bin/perl
checking for gnroff... no
checking for nroff... /usr/bin/nroff
checking how to use *nroff to get plain text from man pages... -man
checking whether to enable the threaded resolver... yes
checking whether to use POSIX threads for threaded resolver... auto
checking for pthread.h... yes
checking for pthread_create... yes
checking convert -I options to -isystem... yes
checking whether to enable verbose strings... yes
checking whether to enable SSPI support (Windows native builds only)... no
checking whether to enable cryptographic authentication methods... yes
checking whether to enable NTLM delegation to winbind's helper... no
checking whether to enable TLS-SRP authentication... yes
checking whether to enable Unix domain sockets... auto
checking for struct sockaddr_un.sun_path... yes
checking whether to support cookies... yes
checking whether to support socketpair... yes
checking whether to support HTTP authentication... yes
checking whether to support DoH... yes
checking whether to support the MIME API... yes
checking whether to support date parsing... yes
checking whether to support netrc parsing... yes
checking whether to support progress-meter... yes
checking whether to support DNS shuffling... yes
checking whether to support curl_easy_option*... yes
checking whether to support alt-svc... no
configure: disables HSTS due to lack of SSL
checking whether hiding of library internal symbols will actually happen... yes
checking that generated files are newer than configure... done
configure: creating ./config.status
config.status: creating Makefile
config.status: creating docs/Makefile
config.status: creating docs/examples/Makefile
config.status: creating docs/libcurl/Makefile
config.status: creating docs/libcurl/opts/Makefile
config.status: creating docs/cmdline-opts/Makefile
config.status: creating include/Makefile
config.status: creating include/curl/Makefile
config.status: creating src/Makefile
config.status: creating lib/Makefile
config.status: creating scripts/Makefile
config.status: creating lib/libcurl.vers
config.status: creating tests/Makefile
config.status: creating tests/certs/Makefile
config.status: creating tests/certs/scripts/Makefile
config.status: creating tests/data/Makefile
config.status: creating tests/server/Makefile
config.status: creating tests/libtest/Makefile
config.status: creating tests/unit/Makefile
config.status: creating packages/Makefile
config.status: creating packages/vms/Makefile
config.status: creating curl-config
config.status: creating libcurl.pc
config.status: creating lib/curl_config.h
config.status: executing depfiles commands
config.status: executing libtool commands
configure: amending lib/Makefile
configure: amending src/Makefile
configure: amending tests/unit/Makefile
configure: amending tests/server/Makefile
configure: amending tests/libtest/Makefile
configure: amending docs/examples/Makefile
configure: Configured to build curl/libcurl:
Host setup: x86_64-pc-linux-gnu
Install prefix: /usr/local
Compiler: ccache gcc
CFLAGS: -Werror-implicit-function-declaration -O2 -Wno-system-headers -Wenum-conversion
CPPFLAGS:
LDFLAGS:
LIBS: -lpsl -lz
curl version: 7.77.0-DEV
SSL: no (--with-{openssl,gnutls,nss,mbedtls,wolfssl,schannel,secure-transport,mesalink,amissl,bearssl,rustls} )
SSH: no (--with-{libssh,libssh2})
zlib: enabled
brotli: no (--with-brotli)
zstd: no (--with-zstd)
GSS-API: no (--with-gssapi)
GSASL: no (libgsasl not found)
TLS-SRP: no (--enable-tls-srp)
resolver: POSIX threaded
IPv6: enabled
Unix sockets: enabled
IDN: no (--with-{libidn2,winidn})
Build libcurl: Shared=no, Static=yes
Built-in manual: enabled
--libcurl option: enabled (--disable-libcurl-option)
Verbose errors: enabled (--disable-verbose)
Code coverage: disabled
SSPI: no (--enable-sspi)
ca cert bundle: no
ca cert path:
ca fallback:
LDAP: no (--enable-ldap / --with-ldap-lib / --with-lber-lib)
LDAPS: no (--enable-ldaps)
RTSP: enabled
RTMP: no (--with-librtmp)
Metalink: no (--with-libmetalink)
PSL: enabled
Alt-svc: enabled (--disable-alt-svc)
HSTS: no (--enable-hsts)
HTTP1: enabled (internal)
HTTP2: no (--with-nghttp2, --with-hyper)
HTTP3: no (--with-ngtcp2, --with-quiche)
ECH: no (--enable-ech)
Protocols: DICT FILE FTP GOPHER HTTP IMAP MQTT POP3 RTSP SMTP TELNET TFTP
Features: AsynchDNS IPv6 Largefile PSL UnixSockets alt-svc libz
configure: WARNING: Cannot find libraries for LDAP support: LDAP disabled
configure: WARNING: SSL disabled, you will not be able to use HTTPS, FTPS, NTLM and more.
configure: WARNING: Use --with-openssl, --with-gnutls, --with-wolfssl, --with-mbedtls, --with-nss, --with-schannel, --with-secure-transport, --with-mesalink, --with-amissl, --with-bearssl or --with-rustls to address this.
configure: WARNING: libgsasl was not found
configure: WARNING: Cannot find libraries for IDN support: IDN disabled
$ make -j3
Making all in lib
make[1]: Entering directory '/root/asi_db/builds/curl/_worktrees/w0/lib'
make all-am
make[2]: Entering directory '/root/asi_db/builds/curl/_worktrees/w0/lib'
CC libcurl_la-altsvc.lo
CC libcurl_la-amigaos.lo
CC libcurl_la-asyn-ares.lo
CC libcurl_la-asyn-thread.lo
CC libcurl_la-base64.lo
CC libcurl_la-c-hyper.lo
CC libcurl_la-conncache.lo
CC libcurl_la-connect.lo
CC libcurl_la-content_encoding.lo
CC libcurl_la-cookie.lo
CC libcurl_la-curl_addrinfo.lo
CC libcurl_la-curl_ctype.lo
CC libcurl_la-curl_des.lo
CC libcurl_la-curl_endian.lo
CC libcurl_la-curl_fnmatch.lo
CC libcurl_la-curl_get_line.lo
CC libcurl_la-curl_gethostname.lo
CC libcurl_la-curl_gssapi.lo
CC libcurl_la-curl_memrchr.lo
CC libcurl_la-curl_multibyte.lo
CC libcurl_la-curl_ntlm_core.lo
CC libcurl_la-curl_ntlm_wb.lo
CC libcurl_la-curl_path.lo
CC libcurl_la-curl_range.lo
CC libcurl_la-curl_rtmp.lo
CC libcurl_la-curl_sasl.lo
CC libcurl_la-curl_sspi.lo
CC libcurl_la-curl_threads.lo
CC libcurl_la-dict.lo
CC libcurl_la-doh.lo
CC libcurl_la-dotdot.lo
CC libcurl_la-dynbuf.lo
CC libcurl_la-easy.lo
CC libcurl_la-easygetopt.lo
CC libcurl_la-easyoptions.lo
CC libcurl_la-escape.lo
CC libcurl_la-file.lo
CC libcurl_la-fileinfo.lo
CC libcurl_la-formdata.lo
CC libcurl_la-ftp.lo
CC libcurl_la-ftplistparser.lo
CC libcurl_la-getenv.lo
CC libcurl_la-getinfo.lo
CC libcurl_la-gopher.lo
CC libcurl_la-hash.lo
CC libcurl_la-hmac.lo
CC libcurl_la-hostasyn.lo
CC libcurl_la-hostcheck.lo
CC libcurl_la-hostip.lo
CC libcurl_la-hostip4.lo
CC libcurl_la-hostip6.lo
CC libcurl_la-hostsyn.lo
CC libcurl_la-hsts.lo
CC libcurl_la-http.lo
CC libcurl_la-http2.lo
CC libcurl_la-http_chunks.lo
CC libcurl_la-http_digest.lo
CC libcurl_la-http_negotiate.lo
CC libcurl_la-http_ntlm.lo
CC libcurl_la-http_proxy.lo
CC libcurl_la-http_aws_sigv4.lo
CC libcurl_la-idn_win32.lo
CC libcurl_la-if2ip.lo
CC libcurl_la-imap.lo
CC libcurl_la-inet_ntop.lo
CC libcurl_la-inet_pton.lo
CC libcurl_la-krb5.lo
CC libcurl_la-ldap.lo
CC libcurl_la-llist.lo
CC libcurl_la-md4.lo
CC libcurl_la-md5.lo
CC libcurl_la-memdebug.lo
CC libcurl_la-mime.lo
CC libcurl_la-mprintf.lo
CC libcurl_la-mqtt.lo
CC libcurl_la-multi.lo
CC libcurl_la-netrc.lo
CC libcurl_la-non-ascii.lo
CC libcurl_la-nonblock.lo
CC libcurl_la-openldap.lo
CC libcurl_la-parsedate.lo
CC libcurl_la-pingpong.lo
CC libcurl_la-pop3.lo
CC libcurl_la-progress.lo
CC libcurl_la-psl.lo
CC libcurl_la-rand.lo
CC libcurl_la-rename.lo
CC libcurl_la-rtsp.lo
CC libcurl_la-select.lo
CC libcurl_la-sendf.lo
CC libcurl_la-setopt.lo
CC libcurl_la-sha256.lo
CC libcurl_la-share.lo
CC libcurl_la-slist.lo
CC libcurl_la-smb.lo
CC libcurl_la-smtp.lo
CC libcurl_la-socketpair.lo
CC libcurl_la-socks.lo
CC libcurl_la-socks_gssapi.lo
CC libcurl_la-socks_sspi.lo
CC libcurl_la-speedcheck.lo
CC libcurl_la-splay.lo
CC libcurl_la-strcase.lo
CC libcurl_la-strdup.lo
CC libcurl_la-strerror.lo
CC libcurl_la-strtok.lo
CC libcurl_la-strtoofft.lo
CC libcurl_la-system_win32.lo
CC libcurl_la-telnet.lo
CC libcurl_la-tftp.lo
CC libcurl_la-timeval.lo
CC libcurl_la-url.lo
CC libcurl_la-transfer.lo
CC libcurl_la-urlapi.lo
CC libcurl_la-version.lo
CC libcurl_la-warnless.lo
CC libcurl_la-version_win32.lo
CC libcurl_la-wildcard.lo
CC libcurl_la-x509asn1.lo
CC vauth/libcurl_la-cleartext.lo
CC vauth/libcurl_la-cram.lo
CC vauth/libcurl_la-digest.lo
CC vauth/libcurl_la-digest_sspi.lo
CC vauth/libcurl_la-gsasl.lo
CC vauth/libcurl_la-krb5_gssapi.lo
CC vauth/libcurl_la-krb5_sspi.lo
CC vauth/libcurl_la-ntlm.lo
CC vauth/libcurl_la-ntlm_sspi.lo
CC vauth/libcurl_la-oauth2.lo
CC vauth/libcurl_la-spnego_gssapi.lo
CC vauth/libcurl_la-spnego_sspi.lo
CC vauth/libcurl_la-vauth.lo
CC vtls/libcurl_la-bearssl.lo
CC vtls/libcurl_la-gskit.lo
CC vtls/libcurl_la-gtls.lo
CC vtls/libcurl_la-keylog.lo
CC vtls/libcurl_la-mbedtls.lo
CC vtls/libcurl_la-mbedtls_threadlock.lo
CC vtls/libcurl_la-mesalink.lo
CC vtls/libcurl_la-nss.lo
CC vtls/libcurl_la-openssl.lo
CC vtls/libcurl_la-rustls.lo
CC vtls/libcurl_la-schannel.lo
CC vtls/libcurl_la-schannel_verify.lo
CC vtls/libcurl_la-sectransp.lo
CC vtls/libcurl_la-vtls.lo
CC vtls/libcurl_la-wolfssl.lo
CC vquic/libcurl_la-ngtcp2.lo
CC vquic/libcurl_la-quiche.lo
CC vquic/libcurl_la-vquic.lo
CC vssh/libcurl_la-libssh.lo
CC vssh/libcurl_la-libssh2.lo
CC vssh/libcurl_la-wolfssh.lo
CCLD libcurl.la
make[2]: Leaving directory '/root/asi_db/builds/curl/_worktrees/w0/lib'
make[1]: Leaving directory '/root/asi_db/builds/curl/_worktrees/w0/lib'
Making all in src
make[1]: Entering directory '/root/asi_db/builds/curl/_worktrees/w0/src'
Making all in ../docs
make[2]: Entering directory '/root/asi_db/builds/curl/_worktrees/w0/docs'
Making all in .
make[3]: Entering directory '/root/asi_db/builds/curl/_worktrees/w0/docs'
if test "..x" != "..x" -a -e "./curl.1"; then \
/usr/bin/install -c -m 644 "./curl.1" /root/asi_db/builds/curl/_worktrees/w0/docs/curl.1; fi
cd cmdline-opts && make
make[4]: Entering directory '/root/asi_db/builds/curl/_worktrees/w0/docs/cmdline-opts'
generate ../../docs/curl.1
make[4]: Leaving directory '/root/asi_db/builds/curl/_worktrees/w0/docs/cmdline-opts'
make[3]: Leaving directory '/root/asi_db/builds/curl/_worktrees/w0/docs'
Making all in cmdline-opts
make[3]: Entering directory '/root/asi_db/builds/curl/_worktrees/w0/docs/cmdline-opts'
make[3]: Nothing to be done for 'all'.
make[3]: Leaving directory '/root/asi_db/builds/curl/_worktrees/w0/docs/cmdline-opts'
make[2]: Leaving directory '/root/asi_db/builds/curl/_worktrees/w0/docs'
make[2]: Entering directory '/root/asi_db/builds/curl/_worktrees/w0/src'
CC curl-slist_wc.o
CC curl-tool_binmode.o
CC curl-tool_bname.o
CC curl-tool_cb_dbg.o
CC curl-tool_cb_hdr.o
CC curl-tool_cb_prg.o
CC curl-tool_cb_rea.o
CC curl-tool_cb_see.o
CC curl-tool_cb_wrt.o
CC curl-tool_cfgable.o
CC curl-tool_convert.o
CC curl-tool_dirhie.o
CC curl-tool_doswin.o
CC curl-tool_easysrc.o
CC curl-tool_filetime.o
CC curl-tool_formparse.o
CC curl-tool_getparam.o
CC curl-tool_getpass.o
CC curl-tool_help.o
CC curl-tool_helpers.o
CC curl-tool_homedir.o
HUGE tool_hugehelp.c
CC curl-tool_libinfo.o
CC curl-tool_main.o
CC curl-tool_metalink.o
CC curl-tool_msgs.o
CC curl-tool_operate.o
CC curl-tool_operhlp.o
CC curl-tool_panykey.o
CC curl-tool_paramhlp.o
CC curl-tool_parsecfg.o
CC curl-tool_progress.o
CC curl-tool_strdup.o
CC curl-tool_setopt.o
CC curl-tool_sleep.o
CC curl-tool_urlglob.o
CC curl-tool_util.o
CC curl-tool_vms.o
CC curl-tool_writeout.o
CC curl-tool_writeout_json.o
CC curl-tool_xattr.o
CC ../lib/curl-strtoofft.o
CC ../lib/curl-nonblock.o
CC ../lib/curl-warnless.o
CC ../lib/curl-curl_ctype.o
CC ../lib/curl-curl_multibyte.o
CC ../lib/curl-version_win32.o
CC ../lib/curl-dynbuf.o
CC curl-tool_hugehelp.o
CCLD curl
make[2]: Leaving directory '/root/asi_db/builds/curl/_worktrees/w0/src'
make[1]: Leaving directory '/root/asi_db/builds/curl/_worktrees/w0/src'
make[1]: Entering directory '/root/asi_db/builds/curl/_worktrees/w0'
make[1]: Nothing to be done for 'all-am'.
make[1]: Leaving directory '/root/asi_db/builds/curl/_worktrees/w0'
| @@ -67,6 +67,7 @@ | |
| #define CURL_BUILD_IOS_7 0 | |
| #define CURL_BUILD_IOS_9 0 | |
| #define CURL_BUILD_IOS_11 0 | |
| + | #define CURL_BUILD_IOS_13 0 |
| #define CURL_BUILD_MAC 1 | |
| /* This is the maximum API level we are allowed to use when building: */ | |
| #define CURL_BUILD_MAC_10_5 MAC_OS_X_VERSION_MAX_ALLOWED >= 1050 | |
| @@ -76,6 +77,7 @@ | |
| #define CURL_BUILD_MAC_10_9 MAC_OS_X_VERSION_MAX_ALLOWED >= 1090 | |
| #define CURL_BUILD_MAC_10_11 MAC_OS_X_VERSION_MAX_ALLOWED >= 101100 | |
| #define CURL_BUILD_MAC_10_13 MAC_OS_X_VERSION_MAX_ALLOWED >= 101300 | |
| + | #define CURL_BUILD_MAC_10_15 MAC_OS_X_VERSION_MAX_ALLOWED >= 101500 |
| /* These macros mean "the following code is present to allow runtime backward | |
| compatibility with at least this cat or earlier": | |
| (You set this at build-time using the compiler command line option | |
| @@ -91,6 +93,7 @@ | |
| #define CURL_BUILD_IOS_7 __IPHONE_OS_VERSION_MAX_ALLOWED >= 70000 | |
| #define CURL_BUILD_IOS_9 __IPHONE_OS_VERSION_MAX_ALLOWED >= 90000 | |
| #define CURL_BUILD_IOS_11 __IPHONE_OS_VERSION_MAX_ALLOWED >= 110000 | |
| + | #define CURL_BUILD_IOS_13 __IPHONE_OS_VERSION_MAX_ALLOWED >= 130000 |
| #define CURL_BUILD_MAC 0 | |
| #define CURL_BUILD_MAC_10_5 0 | |
| #define CURL_BUILD_MAC_10_6 0 | |
| @@ -99,6 +102,7 @@ | |
| #define CURL_BUILD_MAC_10_9 0 | |
| #define CURL_BUILD_MAC_10_11 0 | |
| #define CURL_BUILD_MAC_10_13 0 | |
| + | #define CURL_BUILD_MAC_10_15 0 |
| #define CURL_SUPPORT_MAC_10_5 0 | |
| #define CURL_SUPPORT_MAC_10_6 0 | |
| #define CURL_SUPPORT_MAC_10_7 0 | |
| @@ -138,6 +142,636 @@ struct ssl_backend_data { | |
| size_t ssl_write_buffered_length; | |
| }; | |
| + | struct st_cipher { |
| + | const char *name; /* Cipher suite IANA name. It starts with "TLS_" prefix */ |
| + | const char *alias_name; /* Alias name is the same as OpenSSL cipher name */ |
| + | SSLCipherSuite num; /* Cipher suite code/number defined in IANA registry */ |
| + | bool weak; /* Flag to mark cipher as weak based on previous implementation |
| + | of Secure Transport back-end by CURL */ |
| + | }; |
| + | |
| + | /* Macro to initialize st_cipher data structure: stringify id to name, cipher |
| + | number/id, 'weak' suite flag |
| + | */ |
| + | #define CIPHER_DEF(num, alias, weak) \ |
| + | { #num, alias, num, weak } |
| + | |
| + | /* |
| + | Macro to initialize st_cipher data structure with name, code (IANA cipher |
| + | number/id value), and 'weak' suite flag. The first 28 cipher suite numbers |
| + | have the same IANA code for both SSL and TLS standards: numbers 0x0000 to |
| + | 0x001B. They have different names though. The first 4 letters of the cipher |
| + | suite name are the protocol name: "SSL_" or "TLS_", rest of the IANA name is |
| + | the same for both SSL and TLS cipher suite name. |
| + | The second part of the problem is that macOS/iOS SDKs don't define all TLS |
| + | codes but only 12 of them. The SDK defines all SSL codes though, i.e. SSL_NUM |
| + | constant is always defined for those 28 ciphers while TLS_NUM is defined only |
| + | for 12 of the first 28 ciphers. Those 12 TLS cipher codes match to |
| + | corresponding SSL enum value and represent the same cipher suite. Therefore |
| + | we'll use the SSL enum value for those cipher suites because it is defined |
| + | for all 28 of them. |
| + | We make internal data consistent and based on TLS names, i.e. all st_cipher |
| + | item names start with the "TLS_" prefix. |
| + | Summarizing all the above, those 28 first ciphers are presented in our table |
| + | with both TLS and SSL names. Their cipher numbers are assigned based on the |
| + | SDK enum value for the SSL cipher, which matches to IANA TLS number. |
| + | */ |
| + | #define CIPHER_DEF_SSLTLS(num_wo_prefix, alias, weak) \ |
| + | { "TLS_" #num_wo_prefix, alias, SSL_##num_wo_prefix, weak } |
| + | |
| + | /* |
| + | Cipher suites were marked as weak based on the following: |
| + | RC4 encryption - rfc7465, the document contains a list of deprecated ciphers. |
| + | Marked in the code below as weak. |
| + | RC2 encryption - many mentions, was found vulnerable to a relatively easy |
| + | attack https://link.springer.com/chapter/10.1007%2F3-540-69710-1_14 |
| + | Marked in the code below as weak. |
| + | DES and IDEA encryption - rfc5469, has a list of deprecated ciphers. |
| + | Marked in the code below as weak. |
| + | Anonymous Diffie-Hellman authentication and anonymous elliptic curve |
| + | Diffie-Hellman - vulnerable to a man-in-the-middle attack. Deprecated by |
| + | RFC 4346 aka TLS 1.1 (section A.5, page 60) |
| + | Null bulk encryption suites - not encrypted communication |
| + | Export ciphers, i.e. ciphers with restrictions to be used outside the US for |
| + | software exported to some countries, they were excluded from TLS 1.1 |
| + | version. More precisely, they were noted as ciphers which MUST NOT be |
| + | negotiated in RFC 4346 aka TLS 1.1 (section A.5, pages 60 and 61). |
| + | All of those filters were considered weak because they contain a weak |
| + | algorithm like DES, RC2 or RC4, and already considered weak by other |
| + | criteria. |
| + | 3DES - NIST deprecated it and is going to retire it by 2023 |
| + | https://csrc.nist.gov/News/2017/Update-to-Current-Use-and-Deprecation-of-TDEA |
| + | OpenSSL https://www.openssl.org/blog/blog/2016/08/24/sweet32/ also |
| + | deprecated those ciphers. Some other libraries also consider it |
| + | vulnerable or at least not strong enough. |
| + | |
| + | CBC ciphers are vulnerable with SSL3.0 and TLS1.0: |
| + | https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance |
| + | /118518-technote-esa-00.html |
| + | We don't take care of this issue because it is resolved by later TLS |
| + | versions and for us, it requires more complicated checks, we need to |
| + | check a protocol version also. Vulnerability doesn't look very critical |
| + | and we do not filter out those cipher suites. |
| + | */ |
| + | |
| + | #define CIPHER_WEAK_NOT_ENCRYPTED TRUE |
| + | #define CIPHER_WEAK_RC_ENCRYPTION TRUE |
| + | #define CIPHER_WEAK_DES_ENCRYPTION TRUE |
| + | #define CIPHER_WEAK_IDEA_ENCRYPTION TRUE |
| + | #define CIPHER_WEAK_ANON_AUTH TRUE |
| + | #define CIPHER_WEAK_3DES_ENCRYPTION TRUE |
| + | #define CIPHER_STRONG_ENOUGH FALSE |
| + | |
| + | /* Please do not change the order of the first ciphers available for SSL. |
| + | Do not insert and do not delete any of them. Code below |
| + | depends on their order and continuity. |
| + | If you add a new cipher, please maintain order by number, i.e. |
| + | insert in between existing items to appropriate place based on |
| + | cipher suite IANA number |
| + | */ |
| + | const static struct st_cipher ciphertable[] = { |
| + | /* SSL version 3.0 and initial TLS 1.0 cipher suites. |
| + | Defined since SDK 10.2.8 */ |
| + | CIPHER_DEF_SSLTLS(NULL_WITH_NULL_NULL, /* 0x0000 */ |
| + | NULL, |
| + | CIPHER_WEAK_NOT_ENCRYPTED), |
| + | CIPHER_DEF_SSLTLS(RSA_WITH_NULL_MD5, /* 0x0001 */ |
| + | "NULL-MD5", |
| + | CIPHER_WEAK_NOT_ENCRYPTED), |
| + | CIPHER_DEF_SSLTLS(RSA_WITH_NULL_SHA, /* 0x0002 */ |
| + | "NULL-SHA", |
| + | CIPHER_WEAK_NOT_ENCRYPTED), |
| + | CIPHER_DEF_SSLTLS(RSA_EXPORT_WITH_RC4_40_MD5, /* 0x0003 */ |
| + | "EXP-RC4-MD5", |
| + | CIPHER_WEAK_RC_ENCRYPTION), |
| + | CIPHER_DEF_SSLTLS(RSA_WITH_RC4_128_MD5, /* 0x0004 */ |
| + | "RC4-MD5", |
| + | CIPHER_WEAK_RC_ENCRYPTION), |
| + | CIPHER_DEF_SSLTLS(RSA_WITH_RC4_128_SHA, /* 0x0005 */ |
| + | "RC4-SHA", |
| + | CIPHER_WEAK_RC_ENCRYPTION), |
| + | CIPHER_DEF_SSLTLS(RSA_EXPORT_WITH_RC2_CBC_40_MD5, /* 0x0006 */ |
| + | "EXP-RC2-CBC-MD5", |
| + | CIPHER_WEAK_RC_ENCRYPTION), |
| + | CIPHER_DEF_SSLTLS(RSA_WITH_IDEA_CBC_SHA, /* 0x0007 */ |
| + | "IDEA-CBC-SHA", |
| + | CIPHER_WEAK_IDEA_ENCRYPTION), |
| + | CIPHER_DEF_SSLTLS(RSA_EXPORT_WITH_DES40_CBC_SHA, /* 0x0008 */ |
| + | "EXP-DES-CBC-SHA", |
| + | CIPHER_WEAK_DES_ENCRYPTION), |
| + | CIPHER_DEF_SSLTLS(RSA_WITH_DES_CBC_SHA, /* 0x0009 */ |
| + | "DES-CBC-SHA", |
| + | CIPHER_WEAK_DES_ENCRYPTION), |
| + | CIPHER_DEF_SSLTLS(RSA_WITH_3DES_EDE_CBC_SHA, /* 0x000A */ |
| + | "DES-CBC3-SHA", |
| + | CIPHER_WEAK_3DES_ENCRYPTION), |
| + | CIPHER_DEF_SSLTLS(DH_DSS_EXPORT_WITH_DES40_CBC_SHA, /* 0x000B */ |
| + | "EXP-DH-DSS-DES-CBC-SHA", |
| + | CIPHER_WEAK_DES_ENCRYPTION), |
| + | CIPHER_DEF_SSLTLS(DH_DSS_WITH_DES_CBC_SHA, /* 0x000C */ |
| + | "DH-DSS-DES-CBC-SHA", |
| + | CIPHER_WEAK_DES_ENCRYPTION), |
| + | CIPHER_DEF_SSLTLS(DH_DSS_WITH_3DES_EDE_CBC_SHA, /* 0x000D */ |
| + | "DH-DSS-DES-CBC3-SHA", |
| + | CIPHER_WEAK_3DES_ENCRYPTION), |
| + | CIPHER_DEF_SSLTLS(DH_RSA_EXPORT_WITH_DES40_CBC_SHA, /* 0x000E */ |
| + | "EXP-DH-RSA-DES-CBC-SHA", |
| + | CIPHER_WEAK_DES_ENCRYPTION), |
| + | CIPHER_DEF_SSLTLS(DH_RSA_WITH_DES_CBC_SHA, /* 0x000F */ |
| + | "DH-RSA-DES-CBC-SHA", |
| + | CIPHER_WEAK_DES_ENCRYPTION), |
| + | CIPHER_DEF_SSLTLS(DH_RSA_WITH_3DES_EDE_CBC_SHA, /* 0x0010 */ |
| + | "DH-RSA-DES-CBC3-SHA", |
| + | CIPHER_WEAK_3DES_ENCRYPTION), |
| + | CIPHER_DEF_SSLTLS(DHE_DSS_EXPORT_WITH_DES40_CBC_SHA, /* 0x0011 */ |
| + | "EXP-EDH-DSS-DES-CBC-SHA", |
| + | CIPHER_WEAK_DES_ENCRYPTION), |
| + | CIPHER_DEF_SSLTLS(DHE_DSS_WITH_DES_CBC_SHA, /* 0x0012 */ |
| + | "EDH-DSS-CBC-SHA", |
| + | CIPHER_WEAK_DES_ENCRYPTION), |
| + | CIPHER_DEF_SSLTLS(DHE_DSS_WITH_3DES_EDE_CBC_SHA, /* 0x0013 */ |
| + | "DHE-DSS-DES-CBC3-SHA", |
| + | CIPHER_WEAK_3DES_ENCRYPTION), |
| + | CIPHER_DEF_SSLTLS(DHE_RSA_EXPORT_WITH_DES40_CBC_SHA, /* 0x0014 */ |
| + | "EXP-EDH-RSA-DES-CBC-SHA", |
| + | CIPHER_WEAK_DES_ENCRYPTION), |
| + | CIPHER_DEF_SSLTLS(DHE_RSA_WITH_DES_CBC_SHA, /* 0x0015 */ |
| + | "EDH-RSA-DES-CBC-SHA", |
| + | CIPHER_WEAK_DES_ENCRYPTION), |
| + | CIPHER_DEF_SSLTLS(DHE_RSA_WITH_3DES_EDE_CBC_SHA, /* 0x0016 */ |
| + | "DHE-RSA-DES-CBC3-SHA", |
| + | CIPHER_WEAK_3DES_ENCRYPTION), |
| + | CIPHER_DEF_SSLTLS(DH_anon_EXPORT_WITH_RC4_40_MD5, /* 0x0017 */ |
| + | "EXP-ADH-RC4-MD5", |
| + | CIPHER_WEAK_ANON_AUTH), |
| + | CIPHER_DEF_SSLTLS(DH_anon_WITH_RC4_128_MD5, /* 0x0018 */ |
| + | "ADH-RC4-MD5", |
| + | CIPHER_WEAK_ANON_AUTH), |
| + | CIPHER_DEF_SSLTLS(DH_anon_EXPORT_WITH_DES40_CBC_SHA, /* 0x0019 */ |
| + | "EXP-ADH-DES-CBC-SHA", |
| + | CIPHER_WEAK_ANON_AUTH), |
| + | CIPHER_DEF_SSLTLS(DH_anon_WITH_DES_CBC_SHA, /* 0x001A */ |
| + | "ADH-DES-CBC-SHA", |
| + | CIPHER_WEAK_ANON_AUTH), |
| + | CIPHER_DEF_SSLTLS(DH_anon_WITH_3DES_EDE_CBC_SHA, /* 0x001B */ |
| + | "ADH-DES-CBC3-SHA", |
| + | CIPHER_WEAK_3DES_ENCRYPTION), |
| + | CIPHER_DEF(SSL_FORTEZZA_DMS_WITH_NULL_SHA, /* 0x001C */ |
| + | NULL, |
| + | CIPHER_WEAK_NOT_ENCRYPTED), |
| + | CIPHER_DEF(SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA, /* 0x001D */ |
| + | NULL, |
| + | CIPHER_STRONG_ENOUGH), |
| + | |
| + | #if CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7 |
| + | /* RFC 4785 - Pre-Shared Key (PSK) Ciphersuites with NULL Encryption */ |
| + | CIPHER_DEF(TLS_PSK_WITH_NULL_SHA, /* 0x002C */ |
| + | "PSK-NULL-SHA", |
| + | CIPHER_WEAK_NOT_ENCRYPTED), |
| + | CIPHER_DEF(TLS_DHE_PSK_WITH_NULL_SHA, /* 0x002D */ |
| + | "DHE-PSK-NULL-SHA", |
| + | CIPHER_WEAK_NOT_ENCRYPTED), |
| + | CIPHER_DEF(TLS_RSA_PSK_WITH_NULL_SHA, /* 0x002E */ |
| + | "RSA-PSK-NULL-SHA", |
| + | CIPHER_WEAK_NOT_ENCRYPTED), |
| + | #endif /* CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7 */ |
| + | |
| + | /* TLS addenda using AES, per RFC 3268. Defined since SDK 10.4u */ |
| + | CIPHER_DEF(TLS_RSA_WITH_AES_128_CBC_SHA, /* 0x002F */ |
| + | "AES128-SHA", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_DH_DSS_WITH_AES_128_CBC_SHA, /* 0x0030 */ |
| + | "DH-DSS-AES128-SHA", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_DH_RSA_WITH_AES_128_CBC_SHA, /* 0x0031 */ |
| + | "DH-RSA-AES128-SHA", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_DHE_DSS_WITH_AES_128_CBC_SHA, /* 0x0032 */ |
| + | "DHE-DSS-AES128-SHA", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_DHE_RSA_WITH_AES_128_CBC_SHA, /* 0x0033 */ |
| + | "DHE-RSA-AES128-SHA", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_DH_anon_WITH_AES_128_CBC_SHA, /* 0x0034 */ |
| + | "ADH-AES128-SHA", |
| + | CIPHER_WEAK_ANON_AUTH), |
| + | CIPHER_DEF(TLS_RSA_WITH_AES_256_CBC_SHA, /* 0x0035 */ |
| + | "AES256-SHA", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_DH_DSS_WITH_AES_256_CBC_SHA, /* 0x0036 */ |
| + | "DH-DSS-AES256-SHA", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_DH_RSA_WITH_AES_256_CBC_SHA, /* 0x0037 */ |
| + | "DH-RSA-AES256-SHA", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_DHE_DSS_WITH_AES_256_CBC_SHA, /* 0x0038 */ |
| + | "DHE-DSS-AES256-SHA", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_DHE_RSA_WITH_AES_256_CBC_SHA, /* 0x0039 */ |
| + | "DHE-RSA-AES256-SHA", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_DH_anon_WITH_AES_256_CBC_SHA, /* 0x003A */ |
| + | "ADH-AES256-SHA", |
| + | CIPHER_WEAK_ANON_AUTH), |
| + | |
| + | #if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS |
| + | /* TLS 1.2 addenda, RFC 5246 */ |
| + | /* Server provided RSA certificate for key exchange. */ |
| + | CIPHER_DEF(TLS_RSA_WITH_NULL_SHA256, /* 0x003B */ |
| + | "NULL-SHA256", |
| + | CIPHER_WEAK_NOT_ENCRYPTED), |
| + | CIPHER_DEF(TLS_RSA_WITH_AES_128_CBC_SHA256, /* 0x003C */ |
| + | "AES128-SHA256", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_RSA_WITH_AES_256_CBC_SHA256, /* 0x003D */ |
| + | "AES256-SHA256", |
| + | CIPHER_STRONG_ENOUGH), |
| + | /* Server-authenticated (and optionally client-authenticated) |
| + | Diffie-Hellman. */ |
| + | CIPHER_DEF(TLS_DH_DSS_WITH_AES_128_CBC_SHA256, /* 0x003E */ |
| + | "DH-DSS-AES128-SHA256", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_DH_RSA_WITH_AES_128_CBC_SHA256, /* 0x003F */ |
| + | "DH-RSA-AES128-SHA256", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, /* 0x0040 */ |
| + | "DHE-DSS-AES128-SHA256", |
| + | CIPHER_STRONG_ENOUGH), |
| + | |
| + | /* TLS 1.2 addenda, RFC 5246 */ |
| + | CIPHER_DEF(TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, /* 0x0067 */ |
| + | "DHE-RSA-AES128-SHA256", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_DH_DSS_WITH_AES_256_CBC_SHA256, /* 0x0068 */ |
| + | "DH-DSS-AES256-SHA256", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_DH_RSA_WITH_AES_256_CBC_SHA256, /* 0x0069 */ |
| + | "DH-RSA-AES256-SHA256", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_DHE_DSS_WITH_AES_256_CBC_SHA256, /* 0x006A */ |
| + | "DHE-DSS-AES256-SHA256", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, /* 0x006B */ |
| + | "DHE-RSA-AES256-SHA256", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_DH_anon_WITH_AES_128_CBC_SHA256, /* 0x006C */ |
| + | "ADH-AES128-SHA256", |
| + | CIPHER_WEAK_ANON_AUTH), |
| + | CIPHER_DEF(TLS_DH_anon_WITH_AES_256_CBC_SHA256, /* 0x006D */ |
| + | "ADH-AES256-SHA256", |
| + | CIPHER_WEAK_ANON_AUTH), |
| + | #endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */ |
| + | |
| + | #if CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7 |
| + | /* Addendum from RFC 4279, TLS PSK */ |
| + | CIPHER_DEF(TLS_PSK_WITH_RC4_128_SHA, /* 0x008A */ |
| + | "PSK-RC4-SHA", |
| + | CIPHER_WEAK_RC_ENCRYPTION), |
| + | CIPHER_DEF(TLS_PSK_WITH_3DES_EDE_CBC_SHA, /* 0x008B */ |
| + | "PSK-3DES-EDE-CBC-SHA", |
| + | CIPHER_WEAK_3DES_ENCRYPTION), |
| + | CIPHER_DEF(TLS_PSK_WITH_AES_128_CBC_SHA, /* 0x008C */ |
| + | "PSK-AES128-CBC-SHA", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_PSK_WITH_AES_256_CBC_SHA, /* 0x008D */ |
| + | "PSK-AES256-CBC-SHA", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_DHE_PSK_WITH_RC4_128_SHA, /* 0x008E */ |
| + | "DHE-PSK-RC4-SHA", |
| + | CIPHER_WEAK_RC_ENCRYPTION), |
| + | CIPHER_DEF(TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA, /* 0x008F */ |
| + | "DHE-PSK-3DES-EDE-CBC-SHA", |
| + | CIPHER_WEAK_3DES_ENCRYPTION), |
| + | CIPHER_DEF(TLS_DHE_PSK_WITH_AES_128_CBC_SHA, /* 0x0090 */ |
| + | "DHE-PSK-AES128-CBC-SHA", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_DHE_PSK_WITH_AES_256_CBC_SHA, /* 0x0091 */ |
| + | "DHE-PSK-AES256-CBC-SHA", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_RSA_PSK_WITH_RC4_128_SHA, /* 0x0092 */ |
| + | "RSA-PSK-RC4-SHA", |
| + | CIPHER_WEAK_RC_ENCRYPTION), |
| + | CIPHER_DEF(TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA, /* 0x0093 */ |
| + | "RSA-PSK-3DES-EDE-CBC-SHA", |
| + | CIPHER_WEAK_3DES_ENCRYPTION), |
| + | CIPHER_DEF(TLS_RSA_PSK_WITH_AES_128_CBC_SHA, /* 0x0094 */ |
| + | "RSA-PSK-AES128-CBC-SHA", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_RSA_PSK_WITH_AES_256_CBC_SHA, /* 0x0095 */ |
| + | "RSA-PSK-AES256-CBC-SHA", |
| + | CIPHER_STRONG_ENOUGH), |
| + | #endif /* CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7 */ |
| + | |
| + | #if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS |
| + | /* Addenda from rfc 5288 AES Galois Counter Mode (GCM) Cipher Suites |
| + | for TLS. */ |
| + | CIPHER_DEF(TLS_RSA_WITH_AES_128_GCM_SHA256, /* 0x009C */ |
| + | "AES128-GCM-SHA256", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_RSA_WITH_AES_256_GCM_SHA384, /* 0x009D */ |
| + | "AES256-GCM-SHA384", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, /* 0x009E */ |
| + | "DHE-RSA-AES128-GCM-SHA256", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, /* 0x009F */ |
| + | "DHE-RSA-AES256-GCM-SHA384", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_DH_RSA_WITH_AES_128_GCM_SHA256, /* 0x00A0 */ |
| + | "DH-RSA-AES128-GCM-SHA256", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_DH_RSA_WITH_AES_256_GCM_SHA384, /* 0x00A1 */ |
| + | "DH-RSA-AES256-GCM-SHA384", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, /* 0x00A2 */ |
| + | "DHE-DSS-AES128-GCM-SHA256", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_DHE_DSS_WITH_AES_256_GCM_SHA384, /* 0x00A3 */ |
| + | "DHE-DSS-AES256-GCM-SHA384", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_DH_DSS_WITH_AES_128_GCM_SHA256, /* 0x00A4 */ |
| + | "DH-DSS-AES128-GCM-SHA256", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_DH_DSS_WITH_AES_256_GCM_SHA384, /* 0x00A5 */ |
| + | "DH-DSS-AES256-GCM-SHA384", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_DH_anon_WITH_AES_128_GCM_SHA256, /* 0x00A6 */ |
| + | "ADH-AES128-GCM-SHA256", |
| + | CIPHER_WEAK_ANON_AUTH), |
| + | CIPHER_DEF(TLS_DH_anon_WITH_AES_256_GCM_SHA384, /* 0x00A7 */ |
| + | "ADH-AES256-GCM-SHA384", |
| + | CIPHER_WEAK_ANON_AUTH), |
| + | #endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */ |
| + | |
| + | #if CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7 |
| + | /* RFC 5487 - PSK with SHA-256/384 and AES GCM */ |
| + | CIPHER_DEF(TLS_PSK_WITH_AES_128_GCM_SHA256, /* 0x00A8 */ |
| + | "PSK-AES128-GCM-SHA256", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_PSK_WITH_AES_256_GCM_SHA384, /* 0x00A9 */ |
| + | "PSK-AES256-GCM-SHA384", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_DHE_PSK_WITH_AES_128_GCM_SHA256, /* 0x00AA */ |
| + | "DHE-PSK-AES128-GCM-SHA256", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_DHE_PSK_WITH_AES_256_GCM_SHA384, /* 0x00AB */ |
| + | "DHE-PSK-AES256-GCM-SHA384", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_RSA_PSK_WITH_AES_128_GCM_SHA256, /* 0x00AC */ |
| + | "RSA-PSK-AES128-GCM-SHA256", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_RSA_PSK_WITH_AES_256_GCM_SHA384, /* 0x00AD */ |
| + | "RSA-PSK-AES256-GCM-SHA384", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_PSK_WITH_AES_128_CBC_SHA256, /* 0x00AE */ |
| + | "PSK-AES128-CBC-SHA256", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_PSK_WITH_AES_256_CBC_SHA384, /* 0x00AF */ |
| + | "PSK-AES256-CBC-SHA384", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_PSK_WITH_NULL_SHA256, /* 0x00B0 */ |
| + | "PSK-NULL-SHA256", |
| + | CIPHER_WEAK_NOT_ENCRYPTED), |
| + | CIPHER_DEF(TLS_PSK_WITH_NULL_SHA384, /* 0x00B1 */ |
| + | "PSK-NULL-SHA384", |
| + | CIPHER_WEAK_NOT_ENCRYPTED), |
| + | CIPHER_DEF(TLS_DHE_PSK_WITH_AES_128_CBC_SHA256, /* 0x00B2 */ |
| + | "DHE-PSK-AES128-CBC-SHA256", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_DHE_PSK_WITH_AES_256_CBC_SHA384, /* 0x00B3 */ |
| + | "DHE-PSK-AES256-CBC-SHA384", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_DHE_PSK_WITH_NULL_SHA256, /* 0x00B4 */ |
| + | "DHE-PSK-NULL-SHA256", |
| + | CIPHER_WEAK_NOT_ENCRYPTED), |
| + | CIPHER_DEF(TLS_DHE_PSK_WITH_NULL_SHA384, /* 0x00B5 */ |
| + | "DHE-PSK-NULL-SHA384", |
| + | CIPHER_WEAK_NOT_ENCRYPTED), |
| + | CIPHER_DEF(TLS_RSA_PSK_WITH_AES_128_CBC_SHA256, /* 0x00B6 */ |
| + | "RSA-PSK-AES128-CBC-SHA256", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_RSA_PSK_WITH_AES_256_CBC_SHA384, /* 0x00B7 */ |
| + | "RSA-PSK-AES256-CBC-SHA384", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_RSA_PSK_WITH_NULL_SHA256, /* 0x00B8 */ |
| + | "RSA-PSK-NULL-SHA256", |
| + | CIPHER_WEAK_NOT_ENCRYPTED), |
| + | CIPHER_DEF(TLS_RSA_PSK_WITH_NULL_SHA384, /* 0x00B9 */ |
| + | "RSA-PSK-NULL-SHA384", |
| + | CIPHER_WEAK_NOT_ENCRYPTED), |
| + | #endif /* CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7 */ |
| + | |
| + | /* RFC 5746 - Secure Renegotiation. This is not a real suite, |
| + | it is a response to initiate negotiation again */ |
| + | CIPHER_DEF(TLS_EMPTY_RENEGOTIATION_INFO_SCSV, /* 0x00FF */ |
| + | NULL, |
| + | CIPHER_STRONG_ENOUGH), |
| + | |
| + | #if CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11 |
| + | /* TLS 1.3 standard cipher suites for ChaCha20+Poly1305. |
| + | Note: TLS 1.3 ciphersuites do not specify the key exchange |
| + | algorithm -- they only specify the symmetric ciphers. |
| + | Cipher alias name matches to OpenSSL cipher name, and for |
| + | TLS 1.3 ciphers */ |
| + | CIPHER_DEF(TLS_AES_128_GCM_SHA256, /* 0x1301 */ |
| + | NULL, /* The OpenSSL cipher name matches to the IANA name */ |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_AES_256_GCM_SHA384, /* 0x1302 */ |
| + | NULL, /* The OpenSSL cipher name matches to the IANA name */ |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_CHACHA20_POLY1305_SHA256, /* 0x1303 */ |
| + | NULL, /* The OpenSSL cipher name matches to the IANA name */ |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_AES_128_CCM_SHA256, /* 0x1304 */ |
| + | NULL, /* The OpenSSL cipher name matches to the IANA name */ |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_AES_128_CCM_8_SHA256, /* 0x1305 */ |
| + | NULL, /* The OpenSSL cipher name matches to the IANA name */ |
| + | CIPHER_STRONG_ENOUGH), |
| + | #endif /* CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11 */ |
| + | |
| + | #if CURL_BUILD_MAC_10_6 || CURL_BUILD_IOS |
| + | /* ECDSA addenda, RFC 4492 */ |
| + | CIPHER_DEF(TLS_ECDH_ECDSA_WITH_NULL_SHA, /* 0xC001 */ |
| + | "ECDH-ECDSA-NULL-SHA", |
| + | CIPHER_WEAK_NOT_ENCRYPTED), |
| + | CIPHER_DEF(TLS_ECDH_ECDSA_WITH_RC4_128_SHA, /* 0xC002 */ |
| + | "ECDH-ECDSA-RC4-SHA", |
| + | CIPHER_WEAK_RC_ENCRYPTION), |
| + | CIPHER_DEF(TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, /* 0xC003 */ |
| + | "ECDH-ECDSA-DES-CBC3-SHA", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, /* 0xC004 */ |
| + | "ECDH-ECDSA-AES128-SHA", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, /* 0xC005 */ |
| + | "ECDH-ECDSA-AES256-SHA", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_NULL_SHA, /* 0xC006 */ |
| + | "ECDHE-ECDSA-NULL-SHA", |
| + | CIPHER_WEAK_NOT_ENCRYPTED), |
| + | CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, /* 0xC007 */ |
| + | "ECDHE-ECDSA-RC4-SHA", |
| + | CIPHER_WEAK_RC_ENCRYPTION), |
| + | CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, /* 0xC008 */ |
| + | "ECDHE-ECDSA-DES-CBC3-SHA", |
| + | CIPHER_WEAK_3DES_ENCRYPTION), |
| + | CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, /* 0xC009 */ |
| + | "ECDHE-ECDSA-AES128-SHA", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, /* 0xC00A */ |
| + | "ECDHE-ECDSA-AES256-SHA", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_ECDH_RSA_WITH_NULL_SHA, /* 0xC00B */ |
| + | "ECDH-RSA-NULL-SHA", |
| + | CIPHER_WEAK_NOT_ENCRYPTED), |
| + | CIPHER_DEF(TLS_ECDH_RSA_WITH_RC4_128_SHA, /* 0xC00C */ |
| + | "ECDH-RSA-RC4-SHA", |
| + | CIPHER_WEAK_RC_ENCRYPTION), |
| + | CIPHER_DEF(TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, /* 0xC00D */ |
| + | "ECDH-RSA-DES-CBC3-SHA", |
| + | CIPHER_WEAK_3DES_ENCRYPTION), |
| + | CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, /* 0xC00E */ |
| + | "ECDH-RSA-AES128-SHA", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, /* 0xC00F */ |
| + | "ECDH-RSA-AES256-SHA", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_ECDHE_RSA_WITH_NULL_SHA, /* 0xC010 */ |
| + | "ECDHE-RSA-NULL-SHA", |
| + | CIPHER_WEAK_NOT_ENCRYPTED), |
| + | CIPHER_DEF(TLS_ECDHE_RSA_WITH_RC4_128_SHA, /* 0xC011 */ |
| + | "ECDHE-RSA-RC4-SHA", |
| + | CIPHER_WEAK_RC_ENCRYPTION), |
| + | CIPHER_DEF(TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, /* 0xC012 */ |
| + | "ECDHE-RSA-DES-CBC3-SHA", |
| + | CIPHER_WEAK_3DES_ENCRYPTION), |
| + | CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, /* 0xC013 */ |
| + | "ECDHE-RSA-AES128-SHA", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, /* 0xC014 */ |
| + | "ECDHE-RSA-AES256-SHA", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_ECDH_anon_WITH_NULL_SHA, /* 0xC015 */ |
| + | "AECDH-NULL-SHA", |
| + | CIPHER_WEAK_ANON_AUTH), |
| + | CIPHER_DEF(TLS_ECDH_anon_WITH_RC4_128_SHA, /* 0xC016 */ |
| + | "AECDH-RC4-SHA", |
| + | CIPHER_WEAK_ANON_AUTH), |
| + | CIPHER_DEF(TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA, /* 0xC017 */ |
| + | "AECDH-DES-CBC3-SHA", |
| + | CIPHER_WEAK_3DES_ENCRYPTION), |
| + | CIPHER_DEF(TLS_ECDH_anon_WITH_AES_128_CBC_SHA, /* 0xC018 */ |
| + | "AECDH-AES128-SHA", |
| + | CIPHER_WEAK_ANON_AUTH), |
| + | CIPHER_DEF(TLS_ECDH_anon_WITH_AES_256_CBC_SHA, /* 0xC019 */ |
| + | "AECDH-AES256-SHA", |
| + | CIPHER_WEAK_ANON_AUTH), |
| + | #endif /* CURL_BUILD_MAC_10_6 || CURL_BUILD_IOS */ |
| + | |
| + | #if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS |
| + | /* Addenda from rfc 5289 Elliptic Curve Cipher Suites with |
| + | HMAC SHA-256/384. */ |
| + | CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, /* 0xC023 */ |
| + | "ECDHE-ECDSA-AES128-SHA256", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, /* 0xC024 */ |
| + | "ECDHE-ECDSA-AES256-SHA384", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, /* 0xC025 */ |
| + | "ECDH-ECDSA-AES128-SHA256", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384, /* 0xC026 */ |
| + | "ECDH-ECDSA-AES256-SHA384", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, /* 0xC027 */ |
| + | "ECDHE-RSA-AES128-SHA256", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, /* 0xC028 */ |
| + | "ECDHE-RSA-AES256-SHA384", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256, /* 0xC029 */ |
| + | "ECDH-RSA-AES128-SHA256", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384, /* 0xC02A */ |
| + | "ECDH-RSA-AES256-SHA384", |
| + | CIPHER_STRONG_ENOUGH), |
| + | /* Addenda from rfc 5289 Elliptic Curve Cipher Suites with |
| + | SHA-256/384 and AES Galois Counter Mode (GCM) */ |
| + | CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, /* 0xC02B */ |
| + | "ECDHE-ECDSA-AES128-GCM-SHA256", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, /* 0xC02C */ |
| + | "ECDHE-ECDSA-AES256-GCM-SHA384", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, /* 0xC02D */ |
| + | "ECDH-ECDSA-AES128-GCM-SHA256", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384, /* 0xC02E */ |
| + | "ECDH-ECDSA-AES256-GCM-SHA384", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, /* 0xC02F */ |
| + | "ECDHE-RSA-AES128-GCM-SHA256", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, /* 0xC030 */ |
| + | "ECDHE-RSA-AES256-GCM-SHA384", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, /* 0xC031 */ |
| + | "ECDH-RSA-AES128-GCM-SHA256", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384, /* 0xC032 */ |
| + | "ECDH-RSA-AES256-GCM-SHA384", |
| + | CIPHER_STRONG_ENOUGH), |
| + | #endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */ |
| + | |
| + | #if CURL_BUILD_MAC_10_15 || CURL_BUILD_IOS_13 |
| + | /* ECDHE_PSK Cipher Suites for Transport Layer Security (TLS), RFC 5489 */ |
| + | CIPHER_DEF(TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA, /* 0xC035 */ |
| + | "ECDHE-PSK-AES128-CBC-SHA", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA, /* 0xC036 */ |
| + | "ECDHE-PSK-AES256-CBC-SHA", |
| + | CIPHER_STRONG_ENOUGH), |
| + | #endif /* CURL_BUILD_MAC_10_15 || CURL_BUILD_IOS_13 */ |
| + | |
| + | #if CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11 |
| + | /* Addenda from rfc 7905 ChaCha20-Poly1305 Cipher Suites for |
| + | Transport Layer Security (TLS). */ |
| + | CIPHER_DEF(TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, /* 0xCCA8 */ |
| + | "ECDHE-RSA-CHACHA20-POLY1305", |
| + | CIPHER_STRONG_ENOUGH), |
| + | CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, /* 0xCCA9 */ |
| + | "ECDHE-ECDSA-CHACHA20-POLY1305", |
| + | CIPHER_STRONG_ENOUGH), |
| + | #endif /* CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11 */ |
| + | |
| + | #if CURL_BUILD_MAC_10_15 || CURL_BUILD_IOS_13 |
| + | /* ChaCha20-Poly1305 Cipher Suites for Transport Layer Security (TLS), |
| + | RFC 7905 */ |
| + | CIPHER_DEF(TLS_PSK_WITH_CHACHA20_POLY1305_SHA256, /* 0xCCAB */ |
| + | "PSK-CHACHA20-POLY1305", |
| + | CIPHER_STRONG_ENOUGH), |
| + | #endif /* CURL_BUILD_MAC_10_15 || CURL_BUILD_IOS_13 */ |
| + | |
| + | /* Tags for SSL 2 cipher kinds which are not specified for SSL 3. |
| + | Defined since SDK 10.2.8 */ |
| + | CIPHER_DEF(SSL_RSA_WITH_RC2_CBC_MD5, /* 0xFF80 */ |
| + | NULL, |
| + | CIPHER_WEAK_RC_ENCRYPTION), |
| + | CIPHER_DEF(SSL_RSA_WITH_IDEA_CBC_MD5, /* 0xFF81 */ |
| + | NULL, |
| + | CIPHER_WEAK_IDEA_ENCRYPTION), |
| + | CIPHER_DEF(SSL_RSA_WITH_DES_CBC_MD5, /* 0xFF82 */ |
| + | NULL, |
| + | CIPHER_WEAK_DES_ENCRYPTION), |
| + | CIPHER_DEF(SSL_RSA_WITH_3DES_EDE_CBC_MD5, /* 0xFF83 */ |
| + | NULL, |
| + | CIPHER_WEAK_3DES_ENCRYPTION), |
| + | }; |
| + | |
| + | #define NUM_OF_CIPHERS sizeof(ciphertable)/sizeof(ciphertable[0]) |
| + | |
| + | |
| /* pinned public key support tests */ | |
| /* version 1 supports macOS 10.12+ and iOS 10+ */ | |
| @@ -295,586 +929,23 @@ static OSStatus SocketWrite(SSLConnectionRef connection, | |
| } | |
| #ifndef CURL_DISABLE_VERBOSE_STRINGS | |
| - | CF_INLINE const char *SSLCipherNameForNumber(SSLCipherSuite cipher) |
| - | { |
| - | switch(cipher) { |
| - | /* SSL version 3.0 */ |
| - | case SSL_RSA_WITH_NULL_MD5: |
| - | return "SSL_RSA_WITH_NULL_MD5"; |
| - | break; |
| - | case SSL_RSA_WITH_NULL_SHA: |
| - | return "SSL_RSA_WITH_NULL_SHA"; |
| - | break; |
| - | case SSL_RSA_EXPORT_WITH_RC4_40_MD5: |
| - | return "SSL_RSA_EXPORT_WITH_RC4_40_MD5"; |
| - | break; |
| - | case SSL_RSA_WITH_RC4_128_MD5: |
| - | return "SSL_RSA_WITH_RC4_128_MD5"; |
| - | break; |
| - | case SSL_RSA_WITH_RC4_128_SHA: |
| - | return "SSL_RSA_WITH_RC4_128_SHA"; |
| - | break; |
| - | case SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5: |
| - | return "SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5"; |
| - | break; |
| - | case SSL_RSA_WITH_IDEA_CBC_SHA: |
| - | return "SSL_RSA_WITH_IDEA_CBC_SHA"; |
| - | break; |
| - | case SSL_RSA_EXPORT_WITH_DES40_CBC_SHA: |
| - | return "SSL_RSA_EXPORT_WITH_DES40_CBC_SHA"; |
| - | break; |
| - | case SSL_RSA_WITH_DES_CBC_SHA: |
| - | return "SSL_RSA_WITH_DES_CBC_SHA"; |
| - | break; |
| - | case SSL_RSA_WITH_3DES_EDE_CBC_SHA: |
| - | return "SSL_RSA_WITH_3DES_EDE_CBC_SHA"; |
| - | break; |
| - | case SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA: |
| - | return "SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA"; |
| - | break; |
| - | case SSL_DH_DSS_WITH_DES_CBC_SHA: |
| - | return "SSL_DH_DSS_WITH_DES_CBC_SHA"; |
| - | break; |
| - | case SSL_DH_DSS_WITH_3DES_EDE_CBC_SHA: |
| - | return "SSL_DH_DSS_WITH_3DES_EDE_CBC_SHA"; |
| - | break; |
| - | case SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA: |
| - | return "SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA"; |
| - | break; |
| - | case SSL_DH_RSA_WITH_DES_CBC_SHA: |
| - | return "SSL_DH_RSA_WITH_DES_CBC_SHA"; |
| - | break; |
| - | case SSL_DH_RSA_WITH_3DES_EDE_CBC_SHA: |
| - | return "SSL_DH_RSA_WITH_3DES_EDE_CBC_SHA"; |
| - | break; |
| - | case SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA: |
| - | return "SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA"; |
| - | break; |
| - | case SSL_DHE_DSS_WITH_DES_CBC_SHA: |
| - | return "SSL_DHE_DSS_WITH_DES_CBC_SHA"; |
| - | break; |
| - | case SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA: |
| - | return "SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA"; |
| - | break; |
| - | case SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA: |
| - | return "SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA"; |
| - | break; |
| - | case SSL_DHE_RSA_WITH_DES_CBC_SHA: |
| - | return "SSL_DHE_RSA_WITH_DES_CBC_SHA"; |
| - | break; |
| - | case SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA: |
| - | return "SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA"; |
| - | break; |
| - | case SSL_DH_anon_EXPORT_WITH_RC4_40_MD5: |
| - | return "SSL_DH_anon_EXPORT_WITH_RC4_40_MD5"; |
| - | break; |
| - | case SSL_DH_anon_WITH_RC4_128_MD5: |
| - | return "SSL_DH_anon_WITH_RC4_128_MD5"; |
| - | break; |
| - | case SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA: |
| - | return "SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA"; |
| - | break; |
| - | case SSL_DH_anon_WITH_DES_CBC_SHA: |
| - | return "SSL_DH_anon_WITH_DES_CBC_SHA"; |
| - | break; |
| - | case SSL_DH_anon_WITH_3DES_EDE_CBC_SHA: |
| - | return "SSL_DH_anon_WITH_3DES_EDE_CBC_SHA"; |
| - | break; |
| - | case SSL_FORTEZZA_DMS_WITH_NULL_SHA: |
| - | return "SSL_FORTEZZA_DMS_WITH_NULL_SHA"; |
| - | break; |
| - | case SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA: |
| - | return "SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA"; |
| - | break; |
| - | /* TLS 1.0 with AES (RFC 3268) |
| - | (Apparently these are used in SSLv3 implementations as well.) */ |
| - | case TLS_RSA_WITH_AES_128_CBC_SHA: |
| - | return "TLS_RSA_WITH_AES_128_CBC_SHA"; |
| - | break; |
| - | case TLS_DH_DSS_WITH_AES_128_CBC_SHA: |
| - | return "TLS_DH_DSS_WITH_AES_128_CBC_SHA"; |
| - | break; |
| - | case TLS_DH_RSA_WITH_AES_128_CBC_SHA: |
| - | return "TLS_DH_RSA_WITH_AES_128_CBC_SHA"; |
| - | break; |
| - | case TLS_DHE_DSS_WITH_AES_128_CBC_SHA: |
| - | return "TLS_DHE_DSS_WITH_AES_128_CBC_SHA"; |
| - | break; |
| - | case TLS_DHE_RSA_WITH_AES_128_CBC_SHA: |
| - | return "TLS_DHE_RSA_WITH_AES_128_CBC_SHA"; |
| - | break; |
| - | case TLS_DH_anon_WITH_AES_128_CBC_SHA: |
| - | return "TLS_DH_anon_WITH_AES_128_CBC_SHA"; |
| - | break; |
| - | case TLS_RSA_WITH_AES_256_CBC_SHA: |
| - | return "TLS_RSA_WITH_AES_256_CBC_SHA"; |
| - | break; |
| - | case TLS_DH_DSS_WITH_AES_256_CBC_SHA: |
| - | return "TLS_DH_DSS_WITH_AES_256_CBC_SHA"; |
| - | break; |
| - | case TLS_DH_RSA_WITH_AES_256_CBC_SHA: |
| - | return "TLS_DH_RSA_WITH_AES_256_CBC_SHA"; |
| - | break; |
| - | case TLS_DHE_DSS_WITH_AES_256_CBC_SHA: |
| - | return "TLS_DHE_DSS_WITH_AES_256_CBC_SHA"; |
| - | break; |
| - | case TLS_DHE_RSA_WITH_AES_256_CBC_SHA: |
| - | return "TLS_DHE_RSA_WITH_AES_256_CBC_SHA"; |
| - | break; |
| - | case TLS_DH_anon_WITH_AES_256_CBC_SHA: |
| - | return "TLS_DH_anon_WITH_AES_256_CBC_SHA"; |
| - | break; |
| - | /* SSL version 2.0 */ |
| - | case SSL_RSA_WITH_RC2_CBC_MD5: |
| - | return "SSL_RSA_WITH_RC2_CBC_MD5"; |
| - | break; |
| - | case SSL_RSA_WITH_IDEA_CBC_MD5: |
| - | return "SSL_RSA_WITH_IDEA_CBC_MD5"; |
| - | break; |
| - | case SSL_RSA_WITH_DES_CBC_MD5: |
| - | return "SSL_RSA_WITH_DES_CBC_MD5"; |
| - | break; |
| - | case SSL_RSA_WITH_3DES_EDE_CBC_MD5: |
| - | return "SSL_RSA_WITH_3DES_EDE_CBC_MD5"; |
| - | break; |
| - | } |
| - | return "SSL_NULL_WITH_NULL_NULL"; |
| - | } |
| - | |
| CF_INLINE const char *TLSCipherNameForNumber(SSLCipherSuite cipher) | |
| { | |
| - | switch(cipher) { |
| - | /* TLS 1.0 with AES (RFC 3268) */ |
| - | case TLS_RSA_WITH_AES_128_CBC_SHA: |
| - | return "TLS_RSA_WITH_AES_128_CBC_SHA"; |
| - | break; |
| - | case TLS_DH_DSS_WITH_AES_128_CBC_SHA: |
| - | return "TLS_DH_DSS_WITH_AES_128_CBC_SHA"; |
| - | break; |
| - | case TLS_DH_RSA_WITH_AES_128_CBC_SHA: |
| - | return "TLS_DH_RSA_WITH_AES_128_CBC_SHA"; |
| - | break; |
| - | case TLS_DHE_DSS_WITH_AES_128_CBC_SHA: |
| - | return "TLS_DHE_DSS_WITH_AES_128_CBC_SHA"; |
| - | break; |
| - | case TLS_DHE_RSA_WITH_AES_128_CBC_SHA: |
| - | return "TLS_DHE_RSA_WITH_AES_128_CBC_SHA"; |
| - | break; |
| - | case TLS_DH_anon_WITH_AES_128_CBC_SHA: |
| - | return "TLS_DH_anon_WITH_AES_128_CBC_SHA"; |
| - | break; |
| - | case TLS_RSA_WITH_AES_256_CBC_SHA: |
| - | return "TLS_RSA_WITH_AES_256_CBC_SHA"; |
| - | break; |
| - | case TLS_DH_DSS_WITH_AES_256_CBC_SHA: |
| - | return "TLS_DH_DSS_WITH_AES_256_CBC_SHA"; |
| - | break; |
| - | case TLS_DH_RSA_WITH_AES_256_CBC_SHA: |
| - | return "TLS_DH_RSA_WITH_AES_256_CBC_SHA"; |
| - | break; |
| - | case TLS_DHE_DSS_WITH_AES_256_CBC_SHA: |
| - | return "TLS_DHE_DSS_WITH_AES_256_CBC_SHA"; |
| - | break; |
| - | case TLS_DHE_RSA_WITH_AES_256_CBC_SHA: |
| - | return "TLS_DHE_RSA_WITH_AES_256_CBC_SHA"; |
| - | break; |
| - | case TLS_DH_anon_WITH_AES_256_CBC_SHA: |
| - | return "TLS_DH_anon_WITH_AES_256_CBC_SHA"; |
| - | break; |
| - | #if CURL_BUILD_MAC_10_6 || CURL_BUILD_IOS |
| - | /* TLS 1.0 with ECDSA (RFC 4492) */ |
| - | case TLS_ECDH_ECDSA_WITH_NULL_SHA: |
| - | return "TLS_ECDH_ECDSA_WITH_NULL_SHA"; |
| - | break; |
| - | case TLS_ECDH_ECDSA_WITH_RC4_128_SHA: |
| - | return "TLS_ECDH_ECDSA_WITH_RC4_128_SHA"; |
| - | break; |
| - | case TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA: |
| - | return "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA"; |
| - | break; |
| - | case TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA: |
| - | return "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA"; |
| - | break; |
| - | case TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA: |
| - | return "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA"; |
| - | break; |
| - | case TLS_ECDHE_ECDSA_WITH_NULL_SHA: |
| - | return "TLS_ECDHE_ECDSA_WITH_NULL_SHA"; |
| - | break; |
| - | case TLS_ECDHE_ECDSA_WITH_RC4_128_SHA: |
| - | return "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA"; |
| - | break; |
| - | case TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA: |
| - | return "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA"; |
| - | break; |
| - | case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA: |
| - | return "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA"; |
| - | break; |
| - | case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA: |
| - | return "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"; |
| - | break; |
| - | case TLS_ECDH_RSA_WITH_NULL_SHA: |
| - | return "TLS_ECDH_RSA_WITH_NULL_SHA"; |
| - | break; |
| - | case TLS_ECDH_RSA_WITH_RC4_128_SHA: |
| - | return "TLS_ECDH_RSA_WITH_RC4_128_SHA"; |
| - | break; |
| - | case TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA: |
| - | return "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA"; |
| - | break; |
| - | case TLS_ECDH_RSA_WITH_AES_128_CBC_SHA: |
| - | return "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA"; |
| - | break; |
| - | case TLS_ECDH_RSA_WITH_AES_256_CBC_SHA: |
| - | return "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA"; |
| - | break; |
| - | case TLS_ECDHE_RSA_WITH_NULL_SHA: |
| - | return "TLS_ECDHE_RSA_WITH_NULL_SHA"; |
| - | break; |
| - | case TLS_ECDHE_RSA_WITH_RC4_128_SHA: |
| - | return "TLS_ECDHE_RSA_WITH_RC4_128_SHA"; |
| - | break; |
| - | case TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA: |
| - | return "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA"; |
| - | break; |
| - | case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA: |
| - | return "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"; |
| - | break; |
| - | case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA: |
| - | return "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"; |
| - | break; |
| - | case TLS_ECDH_anon_WITH_NULL_SHA: |
| - | return "TLS_ECDH_anon_WITH_NULL_SHA"; |
| - | break; |
| - | case TLS_ECDH_anon_WITH_RC4_128_SHA: |
| - | return "TLS_ECDH_anon_WITH_RC4_128_SHA"; |
| - | break; |
| - | case TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA: |
| - | return "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA"; |
| - | break; |
| - | case TLS_ECDH_anon_WITH_AES_128_CBC_SHA: |
| - | return "TLS_ECDH_anon_WITH_AES_128_CBC_SHA"; |
| - | break; |
| - | case TLS_ECDH_anon_WITH_AES_256_CBC_SHA: |
| - | return "TLS_ECDH_anon_WITH_AES_256_CBC_SHA"; |
| - | break; |
| - | #endif /* CURL_BUILD_MAC_10_6 || CURL_BUILD_IOS */ |
| - | #if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS |
| - | /* TLS 1.2 (RFC 5246) */ |
| - | case TLS_RSA_WITH_NULL_MD5: |
| - | return "TLS_RSA_WITH_NULL_MD5"; |
| - | break; |
| - | case TLS_RSA_WITH_NULL_SHA: |
| - | return "TLS_RSA_WITH_NULL_SHA"; |
| - | break; |
| - | case TLS_RSA_WITH_RC4_128_MD5: |
| - | return "TLS_RSA_WITH_RC4_128_MD5"; |
| - | break; |
| - | case TLS_RSA_WITH_RC4_128_SHA: |
| - | return "TLS_RSA_WITH_RC4_128_SHA"; |
| - | break; |
| - | case TLS_RSA_WITH_3DES_EDE_CBC_SHA: |
| - | return "TLS_RSA_WITH_3DES_EDE_CBC_SHA"; |
| - | break; |
| - | case TLS_RSA_WITH_NULL_SHA256: |
| - | return "TLS_RSA_WITH_NULL_SHA256"; |
| - | break; |
| - | case TLS_RSA_WITH_AES_128_CBC_SHA256: |
| - | return "TLS_RSA_WITH_AES_128_CBC_SHA256"; |
| - | break; |
| - | case TLS_RSA_WITH_AES_256_CBC_SHA256: |
| - | return "TLS_RSA_WITH_AES_256_CBC_SHA256"; |
| - | break; |
| - | case TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA: |
| - | return "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA"; |
| - | break; |
| - | case TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA: |
| - | return "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA"; |
| - | break; |
| - | case TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA: |
| - | return "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA"; |
| - | break; |
| - | case TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA: |
| - | return "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA"; |
| - | break; |
| - | case TLS_DH_DSS_WITH_AES_128_CBC_SHA256: |
| - | return "TLS_DH_DSS_WITH_AES_128_CBC_SHA256"; |
| - | break; |
| - | case TLS_DH_RSA_WITH_AES_128_CBC_SHA256: |
| - | return "TLS_DH_RSA_WITH_AES_128_CBC_SHA256"; |
| - | break; |
| - | case TLS_DHE_DSS_WITH_AES_128_CBC_SHA256: |
| - | return "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256"; |
| - | break; |
| - | case TLS_DHE_RSA_WITH_AES_128_CBC_SHA256: |
| - | return "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256"; |
| - | break; |
| - | case TLS_DH_DSS_WITH_AES_256_CBC_SHA256: |
| - | return "TLS_DH_DSS_WITH_AES_256_CBC_SHA256"; |
| - | break; |
| - | case TLS_DH_RSA_WITH_AES_256_CBC_SHA256: |
| - | return "TLS_DH_RSA_WITH_AES_256_CBC_SHA256"; |
| - | break; |
| - | case TLS_DHE_DSS_WITH_AES_256_CBC_SHA256: |
| - | return "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256"; |
| - | break; |
| - | case TLS_DHE_RSA_WITH_AES_256_CBC_SHA256: |
| - | return "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256"; |
| - | break; |
| - | case TLS_DH_anon_WITH_RC4_128_MD5: |
| - | return "TLS_DH_anon_WITH_RC4_128_MD5"; |
| - | break; |
| - | case TLS_DH_anon_WITH_3DES_EDE_CBC_SHA: |
| - | return "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA"; |
| - | break; |
| - | case TLS_DH_anon_WITH_AES_128_CBC_SHA256: |
| - | return "TLS_DH_anon_WITH_AES_128_CBC_SHA256"; |
| - | break; |
| - | case TLS_DH_anon_WITH_AES_256_CBC_SHA256: |
| - | return "TLS_DH_anon_WITH_AES_256_CBC_SHA256"; |
| - | break; |
| - | /* TLS 1.2 with AES GCM (RFC 5288) */ |
| - | case TLS_RSA_WITH_AES_128_GCM_SHA256: |
| - | return "TLS_RSA_WITH_AES_128_GCM_SHA256"; |
| - | break; |
| - | case TLS_RSA_WITH_AES_256_GCM_SHA384: |
| - | return "TLS_RSA_WITH_AES_256_GCM_SHA384"; |
| - | break; |
| - | case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256: |
| - | return "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256"; |
| - | break; |
| - | case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384: |
| - | return "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384"; |
| - | break; |
| - | case TLS_DH_RSA_WITH_AES_128_GCM_SHA256: |
| - | return "TLS_DH_RSA_WITH_AES_128_GCM_SHA256"; |
| - | break; |
| - | case TLS_DH_RSA_WITH_AES_256_GCM_SHA384: |
| - | return "TLS_DH_RSA_WITH_AES_256_GCM_SHA384"; |
| - | break; |
| - | case TLS_DHE_DSS_WITH_AES_128_GCM_SHA256: |
| - | return "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256"; |
| - | break; |
| - | case TLS_DHE_DSS_WITH_AES_256_GCM_SHA384: |
| - | return "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384"; |
| - | break; |
| - | case TLS_DH_DSS_WITH_AES_128_GCM_SHA256: |
| - | return "TLS_DH_DSS_WITH_AES_128_GCM_SHA256"; |
| - | break; |
| - | case TLS_DH_DSS_WITH_AES_256_GCM_SHA384: |
| - | return "TLS_DH_DSS_WITH_AES_256_GCM_SHA384"; |
| - | break; |
| - | case TLS_DH_anon_WITH_AES_128_GCM_SHA256: |
| - | return "TLS_DH_anon_WITH_AES_128_GCM_SHA256"; |
| - | break; |
| - | case TLS_DH_anon_WITH_AES_256_GCM_SHA384: |
| - | return "TLS_DH_anon_WITH_AES_256_GCM_SHA384"; |
| - | break; |
| - | /* TLS 1.2 with elliptic curve ciphers (RFC 5289) */ |
| - | case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256: |
| - | return "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"; |
| - | break; |
| - | case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384: |
| - | return "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384"; |
| - | break; |
| - | case TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256: |
| - | return "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256"; |
| - | break; |
| - | case TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384: |
| - | return "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384"; |
| - | break; |
| - | case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256: |
| - | return "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"; |
| - | break; |
| - | case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384: |
| - | return "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"; |
| - | break; |
| - | case TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256: |
| - | return "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256"; |
| - | break; |
| - | case TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384: |
| - | return "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384"; |
| - | break; |
| - | case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: |
| - | return "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"; |
| - | break; |
| - | case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: |
| - | return "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"; |
| - | break; |
| - | case TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256: |
| - | return "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256"; |
| - | break; |
| - | case TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384: |
| - | return "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384"; |
| - | break; |
| - | case TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: |
| - | return "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"; |
| - | break; |
| - | case TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: |
| - | return "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"; |
| - | break; |
| - | case TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256: |
| - | return "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256"; |
| - | break; |
| - | case TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384: |
| - | return "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384"; |
| - | break; |
| - | case TLS_EMPTY_RENEGOTIATION_INFO_SCSV: |
| - | return "TLS_EMPTY_RENEGOTIATION_INFO_SCSV"; |
| - | break; |
| - | #else |
| - | case SSL_RSA_WITH_NULL_MD5: |
| - | return "TLS_RSA_WITH_NULL_MD5"; |
| - | break; |
| - | case SSL_RSA_WITH_NULL_SHA: |
| - | return "TLS_RSA_WITH_NULL_SHA"; |
| - | break; |
| - | case SSL_RSA_WITH_RC4_128_MD5: |
| - | return "TLS_RSA_WITH_RC4_128_MD5"; |
| - | break; |
| - | case SSL_RSA_WITH_RC4_128_SHA: |
| - | return "TLS_RSA_WITH_RC4_128_SHA"; |
| - | break; |
| - | case SSL_RSA_WITH_3DES_EDE_CBC_SHA: |
| - | return "TLS_RSA_WITH_3DES_EDE_CBC_SHA"; |
| - | break; |
| - | case SSL_DH_anon_WITH_RC4_128_MD5: |
| - | return "TLS_DH_anon_WITH_RC4_128_MD5"; |
| - | break; |
| - | case SSL_DH_anon_WITH_3DES_EDE_CBC_SHA: |
| - | return "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA"; |
| - | break; |
| - | #endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */ |
| - | #if CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7 |
| - | /* TLS PSK (RFC 4279): */ |
| - | case TLS_PSK_WITH_RC4_128_SHA: |
| - | return "TLS_PSK_WITH_RC4_128_SHA"; |
| - | break; |
| - | case TLS_PSK_WITH_3DES_EDE_CBC_SHA: |
| - | return "TLS_PSK_WITH_3DES_EDE_CBC_SHA"; |
| - | break; |
| - | case TLS_PSK_WITH_AES_128_CBC_SHA: |
| - | return "TLS_PSK_WITH_AES_128_CBC_SHA"; |
| - | break; |
| - | case TLS_PSK_WITH_AES_256_CBC_SHA: |
| - | return "TLS_PSK_WITH_AES_256_CBC_SHA"; |
| - | break; |
| - | case TLS_DHE_PSK_WITH_RC4_128_SHA: |
| - | return "TLS_DHE_PSK_WITH_RC4_128_SHA"; |
| - | break; |
| - | case TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA: |
| - | return "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA"; |
| - | break; |
| - | case TLS_DHE_PSK_WITH_AES_128_CBC_SHA: |
| - | return "TLS_DHE_PSK_WITH_AES_128_CBC_SHA"; |
| - | break; |
| - | case TLS_DHE_PSK_WITH_AES_256_CBC_SHA: |
| - | return "TLS_DHE_PSK_WITH_AES_256_CBC_SHA"; |
| - | break; |
| - | case TLS_RSA_PSK_WITH_RC4_128_SHA: |
| - | return "TLS_RSA_PSK_WITH_RC4_128_SHA"; |
| - | break; |
| - | case TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA: |
| - | return "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA"; |
| - | break; |
| - | case TLS_RSA_PSK_WITH_AES_128_CBC_SHA: |
| - | return "TLS_RSA_PSK_WITH_AES_128_CBC_SHA"; |
| - | break; |
| - | case TLS_RSA_PSK_WITH_AES_256_CBC_SHA: |
| - | return "TLS_RSA_PSK_WITH_AES_256_CBC_SHA"; |
| - | break; |
| - | /* More TLS PSK (RFC 4785): */ |
| - | case TLS_PSK_WITH_NULL_SHA: |
| - | return "TLS_PSK_WITH_NULL_SHA"; |
| - | break; |
| - | case TLS_DHE_PSK_WITH_NULL_SHA: |
| - | return "TLS_DHE_PSK_WITH_NULL_SHA"; |
| - | break; |
| - | case TLS_RSA_PSK_WITH_NULL_SHA: |
| - | return "TLS_RSA_PSK_WITH_NULL_SHA"; |
| - | break; |
| - | /* Even more TLS PSK (RFC 5487): */ |
| - | case TLS_PSK_WITH_AES_128_GCM_SHA256: |
| - | return "TLS_PSK_WITH_AES_128_GCM_SHA256"; |
| - | break; |
| - | case TLS_PSK_WITH_AES_256_GCM_SHA384: |
| - | return "TLS_PSK_WITH_AES_256_GCM_SHA384"; |
| - | break; |
| - | case TLS_DHE_PSK_WITH_AES_128_GCM_SHA256: |
| - | return "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256"; |
| - | break; |
| - | case TLS_DHE_PSK_WITH_AES_256_GCM_SHA384: |
| - | return "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384"; |
| - | break; |
| - | case TLS_RSA_PSK_WITH_AES_128_GCM_SHA256: |
| - | return "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256"; |
| - | break; |
| - | case TLS_RSA_PSK_WITH_AES_256_GCM_SHA384: |
| - | return "TLS_PSK_WITH_AES_256_GCM_SHA384"; |
| - | break; |
| - | case TLS_PSK_WITH_AES_128_CBC_SHA256: |
| - | return "TLS_PSK_WITH_AES_128_CBC_SHA256"; |
| - | break; |
| - | case TLS_PSK_WITH_AES_256_CBC_SHA384: |
| - | return "TLS_PSK_WITH_AES_256_CBC_SHA384"; |
| - | break; |
| - | case TLS_PSK_WITH_NULL_SHA256: |
| - | return "TLS_PSK_WITH_NULL_SHA256"; |
| - | break; |
| - | case TLS_PSK_WITH_NULL_SHA384: |
| - | return "TLS_PSK_WITH_NULL_SHA384"; |
| - | break; |
| - | case TLS_DHE_PSK_WITH_AES_128_CBC_SHA256: |
| - | return "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256"; |
| - | break; |
| - | case TLS_DHE_PSK_WITH_AES_256_CBC_SHA384: |
| - | return "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384"; |
| - | break; |
| - | case TLS_DHE_PSK_WITH_NULL_SHA256: |
| - | return "TLS_DHE_PSK_WITH_NULL_SHA256"; |
| - | break; |
| - | case TLS_DHE_PSK_WITH_NULL_SHA384: |
| - | return "TLS_RSA_PSK_WITH_NULL_SHA384"; |
| - | break; |
| - | case TLS_RSA_PSK_WITH_AES_128_CBC_SHA256: |
| - | return "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256"; |
| - | break; |
| - | case TLS_RSA_PSK_WITH_AES_256_CBC_SHA384: |
| - | return "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384"; |
| - | break; |
| - | case TLS_RSA_PSK_WITH_NULL_SHA256: |
| - | return "TLS_RSA_PSK_WITH_NULL_SHA256"; |
| - | break; |
| - | case TLS_RSA_PSK_WITH_NULL_SHA384: |
| - | return "TLS_RSA_PSK_WITH_NULL_SHA384"; |
| - | break; |
| - | #endif /* CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7 */ |
| - | #if CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11 |
| - | /* New ChaCha20+Poly1305 cipher-suites used by TLS 1.3: */ |
| - | case TLS_AES_128_GCM_SHA256: |
| - | return "TLS_AES_128_GCM_SHA256"; |
| - | break; |
| - | case TLS_AES_256_GCM_SHA384: |
| - | return "TLS_AES_256_GCM_SHA384"; |
| - | break; |
| - | case TLS_CHACHA20_POLY1305_SHA256: |
| - | return "TLS_CHACHA20_POLY1305_SHA256"; |
| - | break; |
| - | case TLS_AES_128_CCM_SHA256: |
| - | return "TLS_AES_128_CCM_SHA256"; |
| - | break; |
| - | case TLS_AES_128_CCM_8_SHA256: |
| - | return "TLS_AES_128_CCM_8_SHA256"; |
| - | break; |
| - | case TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256: |
| - | return "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"; |
| - | break; |
| - | case TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256: |
| - | return "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"; |
| - | break; |
| - | #endif /* CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11 */ |
| + | /* The first ciphers in the ciphertable are continuos. Here we do small |
| + | optimization and instead of loop directly get SSL name by cipher number. |
| + | */ |
| + | if(cipher <= SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA) { |
| + | return ciphertable[cipher].name; |
| + | } |
| + | /* Iterate through the rest of the ciphers */ |
| + | for(size_t i = SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA + 1; |
| + | i < NUM_OF_CIPHERS; |
| + | ++i) { |
| + | if(ciphertable[i].num == cipher) { |
| + | return ciphertable[i].name; |
| + | } |
| } | |
| - | return "TLS_NULL_WITH_NULL_NULL"; |
| + | return ciphertable[SSL_NULL_WITH_NULL_NULL].name; |
| } | |
| #endif /* !CURL_DISABLE_VERBOSE_STRINGS */ | |
| @@ -1386,6 +1457,200 @@ set_ssl_version_min_max(struct Curl_easy *data, struct connectdata *conn, | |
| return CURLE_SSL_CONNECT_ERROR; | |
| } | |
| + | static bool is_cipher_suite_strong(SSLCipherSuite suite_num) |
| + | { |
| + | for(size_t i = 0; i < NUM_OF_CIPHERS; ++i) { |
| + | if(ciphertable[i].num == suite_num) { |
| + | return !ciphertable[i].weak; |
| + | } |
| + | } |
| + | /* If the cipher is not in our list, assume it is a new one |
| + | and therefore strong. Previous implementation was the same, |
| + | if cipher suite is not in the list, it was considered strong enough */ |
| + | return true; |
| + | } |
| + | |
| + | static bool is_separator(char c) |
| + | { |
| + | /* Return whether character is a cipher list separator. */ |
| + | switch(c) { |
| + | case ' ': |
| + | case '\t': |
| + | case ':': |
| + | case ',': |
| + | case ';': |
| + | return true; |
| + | } |
| + | return false; |
| + | } |
| + | |
| + | static CURLcode sectransp_set_default_ciphers(struct Curl_easy *data, |
| + | SSLContextRef ssl_ctx) |
| + | { |
| + | size_t all_ciphers_count = 0UL, allowed_ciphers_count = 0UL, i; |
| + | SSLCipherSuite *all_ciphers = NULL, *allowed_ciphers = NULL; |
| + | OSStatus err = noErr; |
| + | |
| + | #if CURL_BUILD_MAC |
| + | int darwinver_maj = 0, darwinver_min = 0; |
| + | |
| + | GetDarwinVersionNumber(&darwinver_maj, &darwinver_min); |
| + | #endif /* CURL_BUILD_MAC */ |
| + | |
| + | /* Disable cipher suites that ST supports but are not safe. These ciphers |
| + | are unlikely to be used in any case since ST gives other ciphers a much |
| + | higher priority, but it's probably better that we not connect at all than |
| + | to give the user a false sense of security if the server only supports |
| + | insecure ciphers. (Note: We don't care about SSLv2-only ciphers.) */ |
| + | err = SSLGetNumberSupportedCiphers(ssl_ctx, &all_ciphers_count); |
| + | if(err != noErr) { |
| + | failf(data, "SSL: SSLGetNumberSupportedCiphers() failed: OSStatus %d", |
| + | err); |
| + | return CURLE_SSL_CIPHER; |
| + | } |
| + | all_ciphers = malloc(all_ciphers_count*sizeof(SSLCipherSuite)); |
| + | if(!all_ciphers) { |
| + | failf(data, "SSL: Failed to allocate memory for all ciphers"); |
| + | return CURLE_OUT_OF_MEMORY; |
| + | } |
| + | allowed_ciphers = malloc(all_ciphers_count*sizeof(SSLCipherSuite)); |
| + | if(!allowed_ciphers) { |
| + | Curl_safefree(all_ciphers); |
| + | failf(data, "SSL: Failed to allocate memory for allowed ciphers"); |
| + | return CURLE_OUT_OF_MEMORY; |
| + | } |
| + | err = SSLGetSupportedCiphers(ssl_ctx, all_ciphers, |
| + | &all_ciphers_count); |
| + | if(err != noErr) { |
| + | Curl_safefree(all_ciphers); |
| + | Curl_safefree(allowed_ciphers); |
| + | return CURLE_SSL_CIPHER; |
| + | } |
| + | for(i = 0UL ; i < all_ciphers_count ; i++) { |
| + | #if CURL_BUILD_MAC |
| + | /* There's a known bug in early versions of Mountain Lion where ST's ECC |
| + | ciphers (cipher suite 0xC001 through 0xC032) simply do not work. |
| + | Work around the problem here by disabling those ciphers if we are |
| + | running in an affected version of OS X. */ |
| + | if(darwinver_maj == 12 && darwinver_min <= 3 && |
| + | all_ciphers[i] >= 0xC001 && all_ciphers[i] <= 0xC032) { |
| + | continue; |
| + | } |
| + | #endif /* CURL_BUILD_MAC */ |
| + | if(is_cipher_suite_strong(all_ciphers[i])) { |
| + | allowed_ciphers[allowed_ciphers_count++] = all_ciphers[i]; |
| + | } |
| + | } |
| + | err = SSLSetEnabledCiphers(ssl_ctx, allowed_ciphers, |
| + | allowed_ciphers_count); |
| + | Curl_safefree(all_ciphers); |
| + | Curl_safefree(allowed_ciphers); |
| + | if(err != noErr) { |
| + | failf(data, "SSL: SSLSetEnabledCiphers() failed: OSStatus %d", err); |
| + | return CURLE_SSL_CIPHER; |
| + | } |
| + | return CURLE_OK; |
| + | } |
| + | |
| + | static CURLcode sectransp_set_selected_ciphers(struct Curl_easy *data, |
| + | SSLContextRef ssl_ctx, |
| + | const char *ciphers) |
| + | { |
| + | size_t ciphers_count = 0; |
| + | const char *cipher_start = ciphers; |
| + | OSStatus err = noErr; |
| + | SSLCipherSuite selected_ciphers[NUM_OF_CIPHERS]; |
| + | |
| + | if(!ciphers) |
| + | return CURLE_OK; |
| + | |
| + | while(is_separator(*ciphers)) /* Skip initial separators. */ |
| + | ciphers++; |
| + | if(!*ciphers) |
| + | return CURLE_OK; |
| + | |
| + | cipher_start = ciphers; |
| + | while(*cipher_start && ciphers_count < NUM_OF_CIPHERS) { |
| + | bool cipher_found = FALSE; |
| + | size_t cipher_len = 0; |
| + | const char *cipher_end = NULL; |
| + | bool tls_name = FALSE; |
| + | |
| + | /* Skip separators */ |
| + | while(is_separator(*cipher_start)) |
| + | cipher_start++; |
| + | if(*cipher_start == '\0') { |
| + | break; |
| + | } |
| + | /* Find last position of a cipher in the ciphers string */ |
| + | cipher_end = cipher_start; |
| + | while (*cipher_end != '\0' && !is_separator(*cipher_end)) { |
| + | ++cipher_end; |
| + | } |
| + | |
| + | /* IANA cipher names start with the TLS_ or SSL_ prefix. |
| + | If the 4th symbol of the cipher is '_' we look for a cipher in the |
| + | table by its (TLS) name. |
| + | Otherwise, we try to match cipher by an alias. */ |
| + | if(cipher_start[3] == '_') { |
| + | tls_name = TRUE; |
| + | } |
| + | /* Iterate through the cipher table and look for the cipher, starting |
| + | the cipher number 0x01 because the 0x00 is not the real cipher */ |
| + | cipher_len = cipher_end - cipher_start; |
| + | for(size_t i = 1; i < NUM_OF_CIPHERS; ++i) { |
| + | const char *table_cipher_name = NULL; |
| + | if(tls_name) { |
| + | table_cipher_name = ciphertable[i].name; |
| + | } |
| + | else if(ciphertable[i].alias_name != NULL) { |
| + | table_cipher_name = ciphertable[i].alias_name; |
| + | } |
| + | else { |
| + | continue; |
| + | } |
| + | /* Compare a part of the string between separators with a cipher name |
| + | in the table and make sure we matched the whole cipher name */ |
| + | if(strncmp(cipher_start, table_cipher_name, cipher_len) == 0 |
| + | && table_cipher_name[cipher_len] == '\0') { |
| + | selected_ciphers[ciphers_count] = ciphertable[i].num; |
| + | ++ciphers_count; |
| + | cipher_found = TRUE; |
| + | break; |
| + | } |
| + | } |
| + | if(!cipher_found) { |
| + | /* It would be more human-readable if we print the wrong cipher name |
| + | but we don't want to allocate any additional memory and copy the name |
| + | into it, then add it into logs. |
| + | Also, we do not modify an original cipher list string. We just point |
| + | to positions where cipher starts and ends in the cipher list string. |
| + | The message is a bit cryptic and longer than necessary but can be |
| + | understood by humans. */ |
| + | failf(data, "SSL: cipher string \"%s\" contains unsupported cipher name" |
| + | " starting position %d and ending position %d", |
| + | ciphers, |
| + | cipher_start - ciphers, |
| + | cipher_end - ciphers); |
| + | return CURLE_SSL_CIPHER; |
| + | } |
| + | if(*cipher_end) { |
| + | cipher_start = cipher_end + 1; |
| + | } |
| + | else { |
| + | break; |
| + | } |
| + | } |
| + | /* All cipher suites in the list are found. Report to logs as-is */ |
| + | infof(data, "SSL: Setting cipher suites list \"%s\"\n", ciphers); |
| + | |
| + | err = SSLSetEnabledCiphers(ssl_ctx, selected_ciphers, ciphers_count); |
| + | if(err != noErr) { |
| + | failf(data, "SSL: SSLSetEnabledCiphers() failed: OSStatus %d", err); |
| + | return CURLE_SSL_CIPHER; |
| + | } |
| + | return CURLE_OK; |
| + | } |
| static CURLcode sectransp_connect_step1(struct Curl_easy *data, | |
| struct connectdata *conn, | |
| @@ -1414,8 +1679,7 @@ static CURLcode sectransp_connect_step1(struct Curl_easy *data, | |
| #else | |
| struct in_addr addr; | |
| #endif /* ENABLE_IPV6 */ | |
| - | size_t all_ciphers_count = 0UL, allowed_ciphers_count = 0UL, i; |
| - | SSLCipherSuite *all_ciphers = NULL, *allowed_ciphers = NULL; |
| + | char *ciphers; |
| OSStatus err = noErr; | |
| #if CURL_BUILD_MAC | |
| int darwinver_maj = 0, darwinver_min = 0; | |
| @@ -1780,121 +2044,16 @@ static CURLcode sectransp_connect_step1(struct Curl_easy *data, | |
| infof(data, "WARNING: disabling hostname validation also disables SNI.\n"); | |
| } | |
| - | /* Disable cipher suites that ST supports but are not safe. These ciphers |
| - | are unlikely to be used in any case since ST gives other ciphers a much |
| - | higher priority, but it's probably better that we not connect at all than |
| - | to give the user a false sense of security if the server only supports |
| - | insecure ciphers. (Note: We don't care about SSLv2-only ciphers.) */ |
| - | err = SSLGetNumberSupportedCiphers(backend->ssl_ctx, &all_ciphers_count); |
| - | if(err != noErr) { |
| - | failf(data, "SSL: SSLGetNumberSupportedCiphers() failed: OSStatus %d", |
| - | err); |
| - | return CURLE_SSL_CIPHER; |
| + | ciphers = SSL_CONN_CONFIG(cipher_list); |
| + | if(ciphers) { |
| + | err = sectransp_set_selected_ciphers(data, backend->ssl_ctx, ciphers); |
| } | |
| - | all_ciphers = malloc(all_ciphers_count*sizeof(SSLCipherSuite)); |
| - | if(!all_ciphers) { |
| - | failf(data, "SSL: Failed to allocate memory for all ciphers"); |
| - | return CURLE_OUT_OF_MEMORY; |
| - | } |
| - | allowed_ciphers = malloc(all_ciphers_count*sizeof(SSLCipherSuite)); |
| - | if(!allowed_ciphers) { |
| - | Curl_safefree(all_ciphers); |
| - | failf(data, "SSL: Failed to allocate memory for allowed ciphers"); |
| - | return CURLE_OUT_OF_MEMORY; |
| - | } |
| - | err = SSLGetSupportedCiphers(backend->ssl_ctx, all_ciphers, |
| - | &all_ciphers_count); |
| - | if(err != noErr) { |
| - | Curl_safefree(all_ciphers); |
| - | Curl_safefree(allowed_ciphers); |
| - | return CURLE_SSL_CIPHER; |
| - | } |
| - | for(i = 0UL ; i < all_ciphers_count ; i++) { |
| - | #if CURL_BUILD_MAC |
| - | /* There's a known bug in early versions of Mountain Lion where ST's ECC |
| - | ciphers (cipher suite 0xC001 through 0xC032) simply do not work. |
| - | Work around the problem here by disabling those ciphers if we are |
| - | running in an affected version of OS X. */ |
| - | if(darwinver_maj == 12 && darwinver_min <= 3 && |
| - | all_ciphers[i] >= 0xC001 && all_ciphers[i] <= 0xC032) { |
| - | continue; |
| - | } |
| - | #endif /* CURL_BUILD_MAC */ |
| - | switch(all_ciphers[i]) { |
| - | /* Disable NULL ciphersuites: */ |
| - | case SSL_NULL_WITH_NULL_NULL: |
| - | case SSL_RSA_WITH_NULL_MD5: |
| - | case SSL_RSA_WITH_NULL_SHA: |
| - | case 0x003B: /* TLS_RSA_WITH_NULL_SHA256 */ |
| - | case SSL_FORTEZZA_DMS_WITH_NULL_SHA: |
| - | case 0xC001: /* TLS_ECDH_ECDSA_WITH_NULL_SHA */ |
| - | case 0xC006: /* TLS_ECDHE_ECDSA_WITH_NULL_SHA */ |
| - | case 0xC00B: /* TLS_ECDH_RSA_WITH_NULL_SHA */ |
| - | case 0xC010: /* TLS_ECDHE_RSA_WITH_NULL_SHA */ |
| - | case 0x002C: /* TLS_PSK_WITH_NULL_SHA */ |
| - | case 0x002D: /* TLS_DHE_PSK_WITH_NULL_SHA */ |
| - | case 0x002E: /* TLS_RSA_PSK_WITH_NULL_SHA */ |
| - | case 0x00B0: /* TLS_PSK_WITH_NULL_SHA256 */ |
| - | case 0x00B1: /* TLS_PSK_WITH_NULL_SHA384 */ |
| - | case 0x00B4: /* TLS_DHE_PSK_WITH_NULL_SHA256 */ |
| - | case 0x00B5: /* TLS_DHE_PSK_WITH_NULL_SHA384 */ |
| - | case 0x00B8: /* TLS_RSA_PSK_WITH_NULL_SHA256 */ |
| - | case 0x00B9: /* TLS_RSA_PSK_WITH_NULL_SHA384 */ |
| - | /* Disable anonymous ciphersuites: */ |
| - | case SSL_DH_anon_EXPORT_WITH_RC4_40_MD5: |
| - | case SSL_DH_anon_WITH_RC4_128_MD5: |
| - | case SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA: |
| - | case SSL_DH_anon_WITH_DES_CBC_SHA: |
| - | case SSL_DH_anon_WITH_3DES_EDE_CBC_SHA: |
| - | case TLS_DH_anon_WITH_AES_128_CBC_SHA: |
| - | case TLS_DH_anon_WITH_AES_256_CBC_SHA: |
| - | case 0xC015: /* TLS_ECDH_anon_WITH_NULL_SHA */ |
| - | case 0xC016: /* TLS_ECDH_anon_WITH_RC4_128_SHA */ |
| - | case 0xC017: /* TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA */ |
| - | case 0xC018: /* TLS_ECDH_anon_WITH_AES_128_CBC_SHA */ |
| - | case 0xC019: /* TLS_ECDH_anon_WITH_AES_256_CBC_SHA */ |
| - | case 0x006C: /* TLS_DH_anon_WITH_AES_128_CBC_SHA256 */ |
| - | case 0x006D: /* TLS_DH_anon_WITH_AES_256_CBC_SHA256 */ |
| - | case 0x00A6: /* TLS_DH_anon_WITH_AES_128_GCM_SHA256 */ |
| - | case 0x00A7: /* TLS_DH_anon_WITH_AES_256_GCM_SHA384 */ |
| - | /* Disable weak key ciphersuites: */ |
| - | case SSL_RSA_EXPORT_WITH_RC4_40_MD5: |
| - | case SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5: |
| - | case SSL_RSA_EXPORT_WITH_DES40_CBC_SHA: |
| - | case SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA: |
| - | case SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA: |
| - | case SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA: |
| - | case SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA: |
| - | case SSL_RSA_WITH_DES_CBC_SHA: |
| - | case SSL_DH_DSS_WITH_DES_CBC_SHA: |
| - | case SSL_DH_RSA_WITH_DES_CBC_SHA: |
| - | case SSL_DHE_DSS_WITH_DES_CBC_SHA: |
| - | case SSL_DHE_RSA_WITH_DES_CBC_SHA: |
| - | /* Disable IDEA: */ |
| - | case SSL_RSA_WITH_IDEA_CBC_SHA: |
| - | case SSL_RSA_WITH_IDEA_CBC_MD5: |
| - | /* Disable RC4: */ |
| - | case SSL_RSA_WITH_RC4_128_MD5: |
| - | case SSL_RSA_WITH_RC4_128_SHA: |
| - | case 0xC002: /* TLS_ECDH_ECDSA_WITH_RC4_128_SHA */ |
| - | case 0xC007: /* TLS_ECDHE_ECDSA_WITH_RC4_128_SHA*/ |
| - | case 0xC00C: /* TLS_ECDH_RSA_WITH_RC4_128_SHA */ |
| - | case 0xC011: /* TLS_ECDHE_RSA_WITH_RC4_128_SHA */ |
| - | case 0x008A: /* TLS_PSK_WITH_RC4_128_SHA */ |
| - | case 0x008E: /* TLS_DHE_PSK_WITH_RC4_128_SHA */ |
| - | case 0x0092: /* TLS_RSA_PSK_WITH_RC4_128_SHA */ |
| - | break; |
| - | default: /* enable everything else */ |
| - | allowed_ciphers[allowed_ciphers_count++] = all_ciphers[i]; |
| - | break; |
| - | } |
| + | else { |
| + | err = sectransp_set_default_ciphers(data, backend->ssl_ctx); |
| } | |
| - | err = SSLSetEnabledCiphers(backend->ssl_ctx, allowed_ciphers, |
| - | allowed_ciphers_count); |
| - | Curl_safefree(all_ciphers); |
| - | Curl_safefree(allowed_ciphers); |
| if(err != noErr) { | |
| - | failf(data, "SSL: SSLSetEnabledCiphers() failed: OSStatus %d", err); |
| + | failf(data, "SSL: Unable to set ciphers for SSL/TLS handshake. " |
| + | "Error code: %d", err); |
| return CURLE_SSL_CIPHER; | |
| } | |
| @@ -2600,11 +2759,11 @@ sectransp_connect_step2(struct Curl_easy *data, struct connectdata *conn, | |
| switch(protocol) { | |
| case kSSLProtocol2: | |
| infof(data, "SSL 2.0 connection using %s\n", | |
| - | SSLCipherNameForNumber(cipher)); |
| + | TLSCipherNameForNumber(cipher)); |
| break; | |
| case kSSLProtocol3: | |
| infof(data, "SSL 3.0 connection using %s\n", | |
| - | SSLCipherNameForNumber(cipher)); |
| + | TLSCipherNameForNumber(cipher)); |
| break; | |
| case kTLSProtocol1: | |
| infof(data, "TLS 1.0 connection using %s\n", | |