-
Notifications
You must be signed in to change notification settings - Fork 7.5k
[curl] Add http3 + remove ssl + openssl default ssl + remove other ssl/tls backend features. #37450
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Closed
Closed
Changes from all commits
Commits
Show all changes
4 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,69 @@ | ||
| diff --git a/CMakeLists.txt b/CMakeLists.txt | ||
| index 656aa7c740facf..c4bea84462679a 100644 | ||
| --- a/CMakeLists.txt | ||
| +++ b/CMakeLists.txt | ||
| @@ -399,6 +399,11 @@ cmake_dependent_option(CURL_USE_BEARSSL "Enable BearSSL for SSL/TLS" OFF CURL_EN | ||
| cmake_dependent_option(CURL_USE_WOLFSSL "Enable wolfSSL for SSL/TLS" OFF CURL_ENABLE_SSL OFF) | ||
| cmake_dependent_option(CURL_USE_GNUTLS "Enable GnuTLS for SSL/TLS" OFF CURL_ENABLE_SSL OFF) | ||
|
|
||
| +option(CURL_USE_CA_NATIVE "Use standard certificate store of operating system" OFF) | ||
| +if(CURL_USE_CA_NATIVE) | ||
| + set(USE_CA_NATIVE ON) | ||
| +endif() | ||
| + | ||
| set(openssl_default ON) | ||
| if(WIN32 OR CURL_USE_SECTRANSP OR CURL_USE_SCHANNEL OR CURL_USE_MBEDTLS OR CURL_USE_WOLFSSL) | ||
| set(openssl_default OFF) | ||
| diff --git a/lib/curl_config.h.cmake b/lib/curl_config.h.cmake | ||
| index 0f4db69820ed17..09f1fd14ca9528 100644 | ||
| --- a/lib/curl_config.h.cmake | ||
| +++ b/lib/curl_config.h.cmake | ||
| @@ -741,6 +741,9 @@ ${SIZEOF_TIME_T_CODE} | ||
| /* to enable Windows SSL */ | ||
| #cmakedefine USE_SCHANNEL 1 | ||
|
|
||
| +/* Use standard certificate store of operating system */ | ||
| +#cmakedefine USE_CA_NATIVE 1 | ||
| + | ||
| /* enable multiple SSL backends */ | ||
| #cmakedefine CURL_WITH_MULTI_SSL 1 | ||
|
|
||
| diff --git a/lib/setopt.c b/lib/setopt.c | ||
| index 8a5a5d7c33d21d..a7ce186baef681 100644 | ||
| --- a/lib/setopt.c | ||
| +++ b/lib/setopt.c | ||
| @@ -2370,6 +2370,9 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param) | ||
| data->set.ssl.no_partialchain = !!(arg & CURLSSLOPT_NO_PARTIALCHAIN); | ||
| data->set.ssl.revoke_best_effort = !!(arg & CURLSSLOPT_REVOKE_BEST_EFFORT); | ||
| data->set.ssl.native_ca_store = !!(arg & CURLSSLOPT_NATIVE_CA); | ||
| +#ifdef USE_CA_NATIVE | ||
| + data->set.ssl.native_ca_store = true; | ||
| +#endif | ||
| data->set.ssl.auto_client_cert = !!(arg & CURLSSLOPT_AUTO_CLIENT_CERT); | ||
| /* If a setting is added here it should also be added in dohprobe() | ||
| which sets its own CURLOPT_SSL_OPTIONS based on these settings. */ | ||
| @@ -2385,6 +2388,9 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param) | ||
| data->set.proxy_ssl.revoke_best_effort = | ||
| !!(arg & CURLSSLOPT_REVOKE_BEST_EFFORT); | ||
| data->set.proxy_ssl.native_ca_store = !!(arg & CURLSSLOPT_NATIVE_CA); | ||
| +#ifdef USE_CA_NATIVE | ||
| + data->set.ssl.native_ca_store = true; | ||
| +#endif | ||
| data->set.proxy_ssl.auto_client_cert = | ||
| !!(arg & CURLSSLOPT_AUTO_CLIENT_CERT); | ||
| break; | ||
| diff --git a/src/tool_getparam.c b/src/tool_getparam.c | ||
| index 52bb24959ddd71..1c1cf596820bcf 100644 | ||
| --- a/src/tool_getparam.c | ||
| +++ b/src/tool_getparam.c | ||
| @@ -2749,7 +2749,9 @@ ParameterError getparameter(const char *flag, /* f or -long-flag */ | ||
| a = NULL; | ||
|
|
||
| } while(!longopt && !singleopt && *++parse && !*usedarg && !err); | ||
| - | ||
| +#ifdef USE_CA_NATIVE | ||
| + config->native_ca_store = true; | ||
| +#endif | ||
| error: | ||
| if(nextalloc) | ||
| free(nextarg); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| diff --git a/CMakeLists.txt b/CMakeLists.txt | ||
| --- a/CMakeLists.txt | ||
| +++ b/CMakeLists.txt | ||
| @@ -719,9 +719,22 @@ | ||
| include_directories(${MSH3_INCLUDE_DIRS}) | ||
| list(APPEND CURL_LIBS ${MSH3_LIBRARIES}) | ||
| endif() | ||
|
|
||
| -if(CURL_WITH_MULTI_SSL AND (USE_NGTCP2 OR USE_QUICHE OR USE_MSH3)) | ||
| +option(USE_OPENSSL_QUIC "Use openssl and nghttp3 libraries for HTTP/3 support" OFF) | ||
| +if(USE_OPENSSL_QUIC) | ||
| + if(USE_NGTCP2 OR USE_QUICHE OR USE_MSH3) | ||
| + message(FATAL_ERROR "Only one HTTP/3 backend can be selected!") | ||
| + endif() | ||
| + find_package(OpenSSL 3.2.0 REQUIRED) | ||
| + | ||
| + find_package(NGHTTP3 REQUIRED) | ||
| + set(USE_NGHTTP3 ON) | ||
| + include_directories(${NGHTTP3_INCLUDE_DIRS}) | ||
| + list(APPEND CURL_LIBS ${NGHTTP3_LIBRARIES}) | ||
| +endif() | ||
| + | ||
| +if(CURL_WITH_MULTI_SSL AND (USE_NGTCP2 OR USE_QUICHE OR USE_MSH3 OR USE_OPENSSL_QUIC)) | ||
| message(FATAL_ERROR "MultiSSL cannot be enabled with HTTP/3 and vice versa.") | ||
| endif() | ||
|
|
||
| if(NOT CURL_DISABLE_SRP AND (HAVE_GNUTLS_SRP OR HAVE_OPENSSL_SRP)) | ||
| @@ -1541,9 +1554,9 @@ | ||
| (use_curl_ntlm_core OR USE_WINDOWS_SSPI) AND | ||
| NOT CURL_DISABLE_HTTP AND NTLM_WB_ENABLED) | ||
| _add_if("TLS-SRP" USE_TLS_SRP) | ||
| _add_if("HTTP2" USE_NGHTTP2) | ||
| - _add_if("HTTP3" USE_NGTCP2 OR USE_QUICHE) | ||
| + _add_if("HTTP3" USE_NGTCP2 OR USE_QUICHE OR USE_OPENSSL_QUIC) | ||
| _add_if("MultiSSL" CURL_WITH_MULTI_SSL) | ||
| # TODO wolfSSL only support this from v5.0.0 onwards | ||
| _add_if("HTTPS-proxy" SSL_ENABLED AND (USE_OPENSSL OR USE_GNUTLS | ||
| OR USE_SCHANNEL OR USE_RUSTLS OR USE_BEARSSL OR | ||
| diff --git a/lib/curl_config.h.cmake b/lib/curl_config.h.cmake | ||
| --- a/lib/curl_config.h.cmake | ||
| +++ b/lib/curl_config.h.cmake | ||
| @@ -719,8 +719,11 @@ | ||
|
|
||
| /* to enable quiche */ | ||
| #cmakedefine USE_QUICHE 1 | ||
|
|
||
| +/* to enable openssl + nghttp3 */ | ||
| +#cmakedefine USE_OPENSSL_QUIC 1 | ||
| + | ||
| /* Define to 1 if you have the quiche_conn_set_qlog_fd function. */ | ||
| #cmakedefine HAVE_QUICHE_CONN_SET_QLOG_FD 1 | ||
|
|
||
| /* to enable msh3 */ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't see a reason why
sslshould be removed andopensslmade the default. Could you explain?There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
You can read all comments in my other PR start with @BillyONeal
#37146 (comment)