Re: [PATCH v2] Allow use of TLS 1.3

[Loganaden Velvindron <logan@hackers.mu>]

On Sat, Mar 24, 2018 at 2:04 AM, Junio C Hamano <gitster@pobox.com> wrote:
> Daniel Stenberg <daniel@haxx.se> writes:
>
>> On Fri, 23 Mar 2018, Loganaden Velvindron wrote:
>>
>>> +#ifdef CURL_SSLVERSION_TLSv1_3
>>> +    { "tlsv1.3", CURL_SSLVERSION_TLSv1_3 }
>>> +#endif
>>
>> Unfortunately, CURL_SSLVERSION_TLSv1_3 is an enum so this construct
>> won't work.
>>
>> Also, let me just point out that 7.52.0 is 0x073400 in hex and not the
>> one used for the first version of this patch.
>

It's working with tls 1.3:

ldd for curl (showing linking to openssl 1.1.1 pre2 preview):
 ldd /usr/local/bin/curl
linux-vdso.so.1 (0x00007ffd30599000)
libcurl.so.4 => /usr/local/lib/libcurl.so.4 (0x00007f5a81845000)
libssl.so.1.1 => /usr/local/lib/libssl.so.1.1 (0x00007f5a815b5000)
libcrypto.so.1.1 => /usr/local/lib/libcrypto.so.1.1 (0x00007f5a810dd000)
libz.so.1 => /usr/lib/libz.so.1 (0x00007f5a80ec6000)
libpthread.so.0 => /usr/lib/libpthread.so.0 (0x00007f5a80ca7000)
libc.so.6 => /usr/lib/libc.so.6 (0x00007f5a808f2000)
libnghttp2.so.14 => /usr/lib/libnghttp2.so.14 (0x00007f5a806cd000)
libdl.so.2 => /usr/lib/libdl.so.2 (0x00007f5a804c9000)
/lib/ld-linux-x86-64.so.2 (0x00007f5a81ce5000)

handshake failure against a tls 1.2 server:

GIT_SSL_VERSION=tlsv1.3 ./git clone https://github.com/shuque/pydig
Cloning into 'pydig'...
warning: templates not found /usr/local/share/git-core/templates
fatal: unable to access 'https://github.com/shuque/pydig/':
error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake
failure

With a local server running nginx using only tls 1.3 (had to disable
ssl verification due to self-signed cert):
GIT_SSL_NO_VERIFY=true GIT_SSL_VERSION=tlsv1.2 ./git clone
https://192.168.1.214/git_test
error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version


Now with TLS 1.3, it works:
GIT_SSL_NO_VERIFY=true GIT_SSL_VERSION=tlsv1.3 ./git clone
https://192.168.1.214/git_test



> Thanks!