commit c2635ec0210b0f94a852935474ac5587a520669c
author Brad King <brad.king@kitware.com> Thu Nov 10 14:58:16 2022 +0000
committer Kitware Robot <kwrobot@kitware.com> Thu Nov 10 09:58:33 2022 -0500
tree bb934e7c58af12eb5e7a5f3a01c8422cbe6422d5
parent e242fa19caa152e7c317fde7f6eb79fb04451982
parent c0a4536cecc2e8574399f0d1d87ad74e92f0be15

Merge topic 'curl-windows-no-tls1.3' into release-3.25

c0a4536cec curl: Disable schannel TLS 1.3 support on Windows 11

Acked-by: Kitware Robot <kwrobot@kitware.com>
Merge-request: !7894

Utilities/cmcurl/lib/vtls/schannel.c

diff --git a/Utilities/cmcurl/lib/vtls/schannel.c b/Utilities/cmcurl/lib/vtls/schannel.c
index 454eb79..e022a2c 100644
--- a/Utilities/cmcurl/lib/vtls/schannel.c
+++ b/Utilities/cmcurl/lib/vtls/schannel.c
@@ -220,6 +220,7 @@
   case CURL_SSLVERSION_MAX_NONE:
   case CURL_SSLVERSION_MAX_DEFAULT:
 
+#if 0 /* Disabled in CMake due to issue 24147 (curl issue 9431) */
     /* Windows Server 2022 and newer (including Windows 11) support TLS 1.3
        built-in. Previous builds of Windows 10 had broken TLS 1.3
        implementations that could be enabled via registry.
@@ -229,6 +230,7 @@
       ssl_version_max = CURL_SSLVERSION_MAX_TLSv1_3;
     }
     else /* Windows 10 and older */
+#endif
       ssl_version_max = CURL_SSLVERSION_MAX_TLSv1_2;
 
     break;
@@ -247,6 +249,7 @@
       break;
     case CURL_SSLVERSION_TLSv1_3:
 
+#if 0 /* Disabled in CMake due to issue 24147 (curl issue 9431) */
       /* Windows Server 2022 and newer */
       if(curlx_verify_windows_version(10, 0, 20348, PLATFORM_WINNT,
                                       VERSION_GREATER_THAN_EQUAL)) {
@@ -257,6 +260,10 @@
         failf(data, "schannel: TLS 1.3 not supported on Windows prior to 11");
         return CURLE_SSL_CONNECT_ERROR;
       }
+#else
+      failf(data, "schannel: TLS 1.3 is not yet supported");
+      return CURLE_SSL_CONNECT_ERROR;
+#endif
     }
   }
   return CURLE_OK;