mirrors/utls
1
0
Fork 0
mirror of https://github.com/refraction-networking/utls.git synced 2025-04-03 20:17:36 +03:00
Code Issues Projects Releases Packages Wiki Activity

crypto/tls: change default minimum version to 1.2

Browse source 
Updates the default from 1.0 -> 1.2 for servers, bringing it in line
with clients. Add a GODEBUG setting, tls10server, which lets users
revert this change.

Fixes #62459

Change-Id: I2b82f85b1c2d527df1f9afefae4ab30a8f0ceb41
Reviewed-on: https://go-review.googlesource.com/c/go/+/541516
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Damien Neil <dneil@google.com>
This commit is contained in:
Roland Shoemaker 2023-11-10 10:12:48 -08:00
parent 59d4a9c7c4
commit 3dc2410818
3 changed files with 27 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

22
handshake_server_test.go
View file

@ -389,21 +389,22 @@ func TestClose(t *testing.T) {
func TestVersion(t *testing.T) {
serverConfig := &Config{
Certificates: testConfig.Certificates,
MaxVersion: VersionTLS11,
MaxVersion: VersionTLS13,
}
clientConfig := &Config{
InsecureSkipVerify: true,
MinVersion: VersionTLS10,
MinVersion: VersionTLS12,
}
state, _, err := testHandshake(t, clientConfig, serverConfig)
if err != nil {
t.Fatalf("handshake failed: %s", err)
}
if state.Version != VersionTLS11 {
if state.Version != VersionTLS13 {
t.Fatalf("incorrect version %x, should be %x", state.Version, VersionTLS11)
}
clientConfig.MinVersion = 0
serverConfig.MaxVersion = VersionTLS11
_, _, err = testHandshake(t, clientConfig, serverConfig)
if err == nil {
t.Fatalf("expected failure to connect with TLS 1.0/1.1")
@ -487,17 +488,17 @@ func testCrossVersionResume(t *testing.T, version uint16) {
InsecureSkipVerify: true,
ClientSessionCache: NewLRUClientSessionCache(1),
ServerName: "servername",
MinVersion: VersionTLS10,
MinVersion: VersionTLS12,
}
// Establish a session at TLS 1.1.
clientConfig.MaxVersion = VersionTLS11
// Establish a session at TLS 1.3.
clientConfig.MaxVersion = VersionTLS13
_, _, err := testHandshake(t, clientConfig, serverConfig)
if err != nil {
t.Fatalf("handshake failed: %s", err)
}
// The client session cache now contains a TLS 1.1 session.
// The client session cache now contains a TLS 1.3 session.
state, _, err := testHandshake(t, clientConfig, serverConfig)
if err != nil {
t.Fatalf("handshake failed: %s", err)
@ -507,7 +508,7 @@ func testCrossVersionResume(t *testing.T, version uint16) {
}
// Test that the server will decline to resume at a lower version.
clientConfig.MaxVersion = VersionTLS10
clientConfig.MaxVersion = VersionTLS12
state, _, err = testHandshake(t, clientConfig, serverConfig)
if err != nil {
t.Fatalf("handshake failed: %s", err)
@ -516,7 +517,7 @@ func testCrossVersionResume(t *testing.T, version uint16) {
t.Fatalf("handshake resumed at a lower version")
}
// The client session cache now contains a TLS 1.0 session.
// The client session cache now contains a TLS 1.2 session.
state, _, err = testHandshake(t, clientConfig, serverConfig)
if err != nil {
t.Fatalf("handshake failed: %s", err)
@ -526,7 +527,7 @@ func testCrossVersionResume(t *testing.T, version uint16) {
}
// Test that the server will decline to resume at a higher version.
clientConfig.MaxVersion = VersionTLS11
clientConfig.MaxVersion = VersionTLS13
state, _, err = testHandshake(t, clientConfig, serverConfig)
if err != nil {
t.Fatalf("handshake failed: %s", err)
@ -1170,6 +1171,7 @@ func TestServerResumptionDisabled(t *testing.T) {
func TestFallbackSCSV(t *testing.T) {
serverConfig := Config{
Certificates: testConfig.Certificates,
MinVersion: VersionTLS11,
}
test := &serverTest{
name: "FallbackSCSV",