Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Regression: In 8.8.0, HTTP3 with QuicTLS errors out with "QUIC needs at least TLS version 1.3" with CURLOPT_SSLVERSION set as documented #13799

Closed
fds242 opened this issue May 27, 2024 · 0 comments
Closed

Regression: In 8.8.0, HTTP3 with QuicTLS errors out with "QUIC needs at least TLS version 1.3" with CURLOPT_SSLVERSION set as documented #13799

fds242 opened this issue May 27, 2024 · 0 comments
Labels
regression TLS

Comments

@fds242
Copy link

fds242 commented May 27, 2024

I did this

The CURLOPT_SSLVERSION option has always been documented as specifying the minimum acceptable version when using the CURL_SSLVERSION_TLSv1_? constants (as opposed to the more recently added CURL_SSLVERSION_MAX_TLSv1_? variants to limit the maximum allowed). A perfectly sensible choice nowadays then is to set CURLOPT_SSLVERSION to CURL_SSLVERSION_TLSv1_2, which has, thus far, meant allowing either TLSv1.2 or TLSv1.3, with HTTP3/QUIC naturally using TLSv1.3 as defined.

Unfortunately 8.8.0 shipped with a new mistaken check in /lib/vtls/openssl.c that confuses the minimum TLS version for the maximum.
For anything other than HTTP3, [lib]curl 8.8.0 continues to work fine and automatically uses TLSv1.3 or v1.2 when set to CURL_SSLVERSION_TLSv1_2, as expected.

Example (assuming quictls/nghttp3/ngtcp2 build):

$ curl --tlsv1.2 --http3-only https://www.cloudflare.com/cdn-cgi/trace

curl: (35) QUIC needs at least TLS version 1.3

I expected the following

Proper functioning with no error message, since we only requested a minimum of TLSv1.2, and did not specify --tls-max 1.2 or lower.
It now fails even if you spell out the maximum as v1.3: curl --tls-max 1.3 --tlsv1.2 --http3-only https://www.cloudflare.com/cdn-cgi/trace

HTTP3 now only works if you outright set either a minimum of 1.3, or leave CURLOPT_SSLVERSION set as CURL_SSLVERSION_DEFAULT.

curl/libcurl version

curl 8.8.0 (x86_64-apple-darwin) libcurl/8.8.0 quictls/3.0.13 zlib/1.2.12 brotli/1.1.0 zstd/1.5.6 libidn2/2.3.7 libssh/0.10.6/openssl/zlib nghttp2/1.62.1 ngtcp2/1.5.0 nghttp3/1.3.0
Release-Date: 2024-05-22
Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns ldap ldaps mqtt pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp
Features: alt-svc AsynchDNS brotli GSS-API HSTS HTTP2 HTTP3 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM SPNEGO SSL threadsafe TLS-SRP UnixSockets zstd

operating system

Not OS dependent (but tested on Darwin 23.5.0 ie. macOS Sonoma 14.5 23F79)
@bagder bagder mentioned this issue May 27, 2024
Closed
bagder added a commit that referenced this issue May 28, 2024
@bagder
openssl: rectify the TLS version check for QUIC
edf0aec 
The version check wrongly complained and return error if the *minimum*
version was set to something less than 1.3. QUIC is always TLS 1.3, but
that means minimum 1.2 is still fine to ask for.

This also renames the local variable to make the mistake harder to make
in the future.

Regression shipped in 8.8.0

Follow-up to 3210101

Reported-by: fds242 on github
Fixes #13799
Closes #13802
@bagder bagder closed this as completed in 582743f May 28, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
regression TLS
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

openssl: rectify the TLS version check for QUIC curl/curl
2 participants
@bagder @fds242