From b7a03712bd7c96e80eb2ef8dc49d43f07a65aa37 Mon Sep 17 00:00:00 2001 From: yuhan6665 <1588741+yuhan6665@users.noreply.github.com> Date: Sun, 25 May 2025 15:34:38 -0400 Subject: [PATCH] crypto/tls: have servers prefer TLS 1.3 when supported Previously the common Config.mutualVersion() code prioritized the selected version based on the provided peerVersions being sent in peer preference order. Instead we would prefer to see TLS 1.3 used whenever it is supported, even if the peer would prefer an older protocol version. This commit updates mutualVersions() to implement this policy change. Our new behaviour matches the behaviour of other TLS stacks, notably BoringSSL, and so also allows enabling the IgnoreClientVersionOrder BoGo test that we otherwise must skip. Updates #72006 Change-Id: I27a2cd231e4b8762b0d9e2dbd3d8ddd5b87fd5cb Reviewed-on: https://go-review.googlesource.com/c/go/+/673236 Auto-Submit: Daniel McCarney TryBot-Bypass: Daniel McCarney Reviewed-by: David Chase Reviewed-by: Roland Shoemaker --- common.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/common.go b/common.go index 19dbd63..5ddf829 100644 --- a/common.go +++ b/common.go @@ -1255,11 +1255,11 @@ func (c *Config) supportsCurve(version uint16, curve CurveID) bool { } // mutualVersion returns the protocol version to use given the advertised -// versions of the peer. Priority is given to the peer preference order. +// versions of the peer. The highest supported version is preferred. func (c *Config) mutualVersion(isClient bool, peerVersions []uint16) (uint16, bool) { supportedVersions := c.supportedVersions(isClient) - for _, v := range peerVersions { - if slices.Contains(supportedVersions, v) { + for _, v := range supportedVersions { + if slices.Contains(peerVersions, v) { return v, true } }