2

I am having an issue with the mac ports implementation of curl.

mbp2016:~ pgee$ which curl
/opt/local/bin/curl

mbp2016:~ pgee$ curl --version
curl 7.80.0 (x86_64-apple-darwin21.1.0) libcurl/7.80.0 OpenSSL/3.0.0 zlib/1.2.11 zstd/1.5.0 libidn2/2.3.2 libpsl/0.21.1 (+libidn2/2.3.2)
Release-Date: 2021-11-10
Protocols: dict file ftp ftps gopher gophers http https imap imaps mqtt pop3 pop3s rtsp smb smbs smtp smtps telnet tftp
Features: alt-svc AsynchDNS HSTS HTTPS-proxy IDN IPv6 Largefile libz NTLM NTLM_WB PSL SSL TLS-SRP UnixSockets zstd

mbp2016:~ pgee$ curl --head https://www.ahpra.gov.au
curl: (35) error:0A000152:SSL routines::unsafe legacy renegotiation disabled

mbp2016:~ pgee$ /usr/bin/curl --version
curl 7.77.0 (x86_64-apple-darwin21.0) libcurl/7.77.0 (SecureTransport) LibreSSL/2.8.3 zlib/1.2.11 nghttp2/1.42.0
Release-Date: 2021-05-26
Protocols: dict file ftp ftps gopher gophers http https imap imaps ldap ldaps mqtt pop3 pop3s rtsp smb smbs smtp smtps telnet tftp
Features: alt-svc AsynchDNS GSS-API HSTS HTTP2 HTTPS-proxy IPv6 Kerberos Largefile libz MultiSSL NTLM NTLM_WB SPNEGO SSL UnixSockets

mbp2016:~ pgee$ /usr/bin/curl --head https://www.ahpra.gov.au
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Length: 160133
Content-Type: text/html; charset=utf-8
Expires: -1
Set-Cookie: AhpraWeb=1piaikc5vpec3wnhon03ab1b; path=/; secure; HttpOnly; SameSite=None
Content-Security-Policy: frame-ancestors 'self'
X-Frame-Options: SAMEORIGIN
P3P: CP="CAO CURa ADMa PSAa PSDa IVAa IVDa HISa OTPa DELa STP COM NAV INT STA"
Date: Sun, 12 Dec 2021 09:47:21 GMT
Set-Cookie: TS018b815b=0159a15e4f400ce883fd78f837a346d5a62bb71ed32f3cd47fb00b7b3e1515b7af8c96c9498324e287a318da5bbaac588926bd3ce4134eced00319de6fd856439860ec84e7; Path=/

So - this shows that the mac-ports installed version (7.80.0) isn't able to connect to a specific server (it can connect with other servers). But the system installed version of curl (7.77.0) does connect to that server.

I did try to force-rebuild curl with :sudo port upgrade -s -n --force curl but that had no effect.

This error causes an issue for my development copy of apache/php and in particular the guzzle library. This was working before the update - any ideas how to fix?

4
  • 1
    It looks like this is an intentional change in OpenSSL 3.0.0; see https://github.com/openssl/openssl/issues/16278. I don't know if curl has an option to allow insecure renegotiation. BTW, I know you don't have control over it, but the server setup has other problems; here's an SSL Labs evaluation. Dec 12, 2021 at 11:37
  • i have spent ages trying to get ports to install an earlier version of curl. i could only go back one version - i downloaded the ports tracker, checked out the version and then run the install - but there were no copies on the repositories to build for previous versions - this version had the same issues. Even using the --insecure option doesn't work.
    – pgee70
    Dec 12, 2021 at 12:23
  • 4
    OpenSSL (which the MacPorts curl is using) is just being careful to prevent a man-in-the-middle attack due to an outdated SSL server to the server you are trying to connect. You can experiment with a different variant of curl without openssl. MacPort offers 3 alternatives - darwinssl, gnutl, and wolfssl (sudo port -v install curl +darwinssl).
    – sfxedit
    Dec 12, 2021 at 14:44
  • @sfxedit that works for me! if you make you comment an answer i will mark as correct.
    – pgee70
    Dec 12, 2021 at 22:33

1 Answer 1

7

As your MacPorts curl --version command shows, it uses OpenSSL 3.0.0 to connect to secure http sites, while the macOS /usr/bin/curl uses LibreSSL 2.8.3 for the same.

The error you are getting for not being able to connect to ahpra.gov.au is due to them using an SSL server without Renegotiation Indication Extension, which makes the secure connection vulnerable to a man-in-the-middle attack. OpenSSL seems to have chosen to be extra cautious here, and thus refuses to establishes a potentially unsafe secure connection. (The link provided by Gordon Davisson discusses this on Github - unsafe legacy renegotiation disabled #16278).

So if you still want to use MacPorts curl, you will have to use it without OpenSSL. Fortunately, Macports does offer different variants of curl that do not use OpenSSL. Macports curl is also available with:

  • darwinssl - Allow secure connections using Apple OS native TLS.
  • gnutls - Allow secure connections using GNU TLS.
  • wolfssl - Allow secure connections using wolfSSL (formerly CyaSSL).

You can thus opt for one of these variants. The MacPorts command to install a different variant of an app is

sudo port install name-of-app +variant

So in your case, if you want to use the macOS built-in library instead of OpenSSL, you should uninstall the current MacPorts curl (sudo port uninstall curl) and install the darwinssl curl variant (sudo port install curl +darwinssl).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .