Skip to content

Fix handling of protocol range in UnityTLS #60

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
simon-lemay-unity merged 1 commit into from
Oct 15, 2026
Merged

Fix handling of protocol range in UnityTLS #60

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 24 additions & 6 deletions lib/vtls/unitytls.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -525,24 +525,42 @@ static CURLcode unitytls_connect_step1(struct Curl_cfilter *cf, struct Curl_easy
backend->pk = NULL;
}

unitytls_tlsctx_protocolrange protocol_range;
unitytls_tlsctx_protocolrange protocol_range = unitytls->UNITYTLS_TLSCTX_PROTOCOLRANGE_DEFAULT;

/* Create and configure context */
switch(conn_config->version) {
case CURL_SSLVERSION_DEFAULT:
protocol_range = unitytls->UNITYTLS_TLSCTX_PROTOCOLRANGE_DEFAULT;
break;
case CURL_SSLVERSION_TLSv1_2:
protocol_range.max = protocol_range.min = UNITYTLS_PROTOCOL_TLS_1_2;
protocol_range.min = UNITYTLS_PROTOCOL_TLS_1_2;
break;
case CURL_SSLVERSION_TLSv1_3:
protocol_range.max = protocol_range.min = UNITYTLS_PROTOCOL_TLS_1_3;
protocol_range.min = UNITYTLS_PROTOCOL_TLS_1_3;
break;
default:
failf(data, "Unrecognized/unsupported parameter passed via CURLOPT_SSLVERSION");
return CURLE_SSL_CONNECT_ERROR;
}

switch(conn_config->version_max) {
case CURL_SSLVERSION_MAX_NONE:
case CURL_SSLVERSION_MAX_DEFAULT:
break;
case CURL_SSLVERSION_MAX_TLSv1_2:
protocol_range.max = UNITYTLS_PROTOCOL_TLS_1_2;
break;
case CURL_SSLVERSION_MAX_TLSv1_3:
protocol_range.max = UNITYTLS_PROTOCOL_TLS_1_3;
break;
default:
failf(data, "UnityTLS only supports TLS 1.2-1.3");
return CURLE_SSL_CONNECT_ERROR;
}

if(protocol_range.min > protocol_range.max) {
failf(data, "Unsupported TLS version range requested via CURLOPT_SSLVERSION");
return CURLE_SSL_CONNECT_ERROR;
}

backend->ctx = unitytls->unitytls_tlsctx_create_client(protocol_range, callbacks, hostname, strlen(hostname), &err);
unitytls->unitytls_tlsctx_set_certificate_callback(backend->ctx, unitytls_on_cert_request, connssl, &err);
unitytls->unitytls_tlsctx_set_x509verify_callback(backend->ctx, unitytls_on_verify, cf, &err);
Expand Down Expand Up @@ -806,4 +824,4 @@ const struct Curl_ssl Curl_ssl_unitytls = {
NULL, /* get_channel_binding */
};

#endif /* USE_UNITYTLS */
#endif /* USE_UNITYTLS */
Loading