mirrors/utls
1
0
Fork 0
mirror of https://github.com/refraction-networking/utls.git synced 2025-04-04 12:37:35 +03:00
Code Issues Projects Releases Packages Wiki Activity

crypto/tls: make SSLv3 again disabled by default

Browse source 
It was mistakenly re-enabled in CL 146217.

Fixes #33837

Change-Id: I8c0e1787114c6232df5888e51e355906622295bc
Reviewed-on: https://go-review.googlesource.com/c/go/+/191877
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
This commit is contained in:
Filippo Valsorda 2019-08-26 16:18:24 -04:00
parent ea863787e2
commit 63a961538b
2 changed files with 18 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
common.go
View file

@ -794,6 +794,10 @@ var supportedVersions = []uint16{
func (c *Config) supportedVersions(isClient bool) []uint16 { func (c *Config) supportedVersions(isClient bool) []uint16 {
versions := make([]uint16, 0, len(supportedVersions)) versions := make([]uint16, 0, len(supportedVersions))
for _, v := range supportedVersions { for _, v := range supportedVersions {
// TLS 1.0 is the default minimum version.
if (c == nil || c.MinVersion == 0) && v < VersionTLS10 {
continue
}
if c != nil && c.MinVersion != 0 && v < c.MinVersion { if c != nil && c.MinVersion != 0 && v < c.MinVersion {
continue continue
} }

14
handshake_server_test.go
View file

@ -77,6 +77,20 @@ func TestRejectBadProtocolVersion(t *testing.T) {
}, "unsupported versions") }, "unsupported versions")
} }
func TestSSLv3OptIn(t *testing.T) {
config := testConfig.Clone()
config.MinVersion = 0
testClientHelloFailure(t, config, &clientHelloMsg{
vers: VersionSSL30,
random: make([]byte, 32),
}, "unsupported versions")
testClientHelloFailure(t, config, &clientHelloMsg{
vers: VersionTLS12,
supportedVersions: []uint16{VersionSSL30},
random: make([]byte, 32),
}, "unsupported versions")
}
func TestNoSuiteOverlap(t *testing.T) { func TestNoSuiteOverlap(t *testing.T) {
clientHello := &clientHelloMsg{ clientHello := &clientHelloMsg{
vers: VersionTLS10, vers: VersionTLS10,