Updated MacPorts curl implementation behaves differently from previous version and macOS curl

Question

I am having an issue with the mac ports implementation of curl.

mbp2016:~ pgee$ which curl
/opt/local/bin/curl

mbp2016:~ pgee$ curl --version
curl 7.80.0 (x86_64-apple-darwin21.1.0) libcurl/7.80.0 OpenSSL/3.0.0 zlib/1.2.11 zstd/1.5.0 libidn2/2.3.2 libpsl/0.21.1 (+libidn2/2.3.2)
Release-Date: 2021-11-10
Protocols: dict file ftp ftps gopher gophers http https imap imaps mqtt pop3 pop3s rtsp smb smbs smtp smtps telnet tftp
Features: alt-svc AsynchDNS HSTS HTTPS-proxy IDN IPv6 Largefile libz NTLM NTLM_WB PSL SSL TLS-SRP UnixSockets zstd

mbp2016:~ pgee$ curl --head https://www.ahpra.gov.au
curl: (35) error:0A000152:SSL routines::unsafe legacy renegotiation disabled

mbp2016:~ pgee$ /usr/bin/curl --version
curl 7.77.0 (x86_64-apple-darwin21.0) libcurl/7.77.0 (SecureTransport) LibreSSL/2.8.3 zlib/1.2.11 nghttp2/1.42.0
Release-Date: 2021-05-26
Protocols: dict file ftp ftps gopher gophers http https imap imaps ldap ldaps mqtt pop3 pop3s rtsp smb smbs smtp smtps telnet tftp
Features: alt-svc AsynchDNS GSS-API HSTS HTTP2 HTTPS-proxy IPv6 Kerberos Largefile libz MultiSSL NTLM NTLM_WB SPNEGO SSL UnixSockets

mbp2016:~ pgee$ /usr/bin/curl --head https://www.ahpra.gov.au
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Length: 160133
Content-Type: text/html; charset=utf-8
Expires: -1
Set-Cookie: AhpraWeb=1piaikc5vpec3wnhon03ab1b; path=/; secure; HttpOnly; SameSite=None
Content-Security-Policy: frame-ancestors 'self'
X-Frame-Options: SAMEORIGIN
P3P: CP="CAO CURa ADMa PSAa PSDa IVAa IVDa HISa OTPa DELa STP COM NAV INT STA"
Date: Sun, 12 Dec 2021 09:47:21 GMT
Set-Cookie: TS018b815b=0159a15e4f400ce883fd78f837a346d5a62bb71ed32f3cd47fb00b7b3e1515b7af8c96c9498324e287a318da5bbaac588926bd3ce4134eced00319de6fd856439860ec84e7; Path=/

So - this shows that the mac-ports installed version (7.80.0) isn't able to connect to a specific server (it can connect with other servers). But the system installed version of curl (7.77.0) does connect to that server.

I did try to force-rebuild curl with :sudo port upgrade -s -n --force curl but that had no effect.

This error causes an issue for my development copy of apache/php and in particular the guzzle library. This was working before the update - any ideas how to fix?

Answer 1

As your MacPorts curl --version command shows, it uses OpenSSL 3.0.0 to connect to secure http sites, while the macOS /usr/bin/curl uses LibreSSL 2.8.3 for the same.

The error you are getting for not being able to connect to ahpra.gov.au is due to them using an SSL server without Renegotiation Indication Extension, which makes the secure connection vulnerable to a man-in-the-middle attack. OpenSSL seems to have chosen to be extra cautious here, and thus refuses to establishes a potentially unsafe secure connection. (The link provided by Gordon Davisson discusses this on Github - unsafe legacy renegotiation disabled #16278).

So if you still want to use MacPorts curl, you will have to use it without OpenSSL. Fortunately, Macports does offer different variants of curl that do not use OpenSSL. Macports curl is also available with:

• darwinssl - Allow secure connections using Apple OS native TLS.
• gnutls - Allow secure connections using GNU TLS.
• wolfssl - Allow secure connections using wolfSSL (formerly CyaSSL).

You can thus opt for one of these variants. The MacPorts command to install a different variant of an app is

sudo port install name-of-app +variant

So in your case, if you want to use the macOS built-in library instead of OpenSSL, you should uninstall the current MacPorts curl (sudo port uninstall curl) and install the darwinssl curl variant (sudo port install curl +darwinssl).