mirrors/XTLS_REALITY
0
0
Fork 0
mirror of https://github.com/XTLS/REALITY.git synced 2025-08-30 10:25:32 +00:00
Code

crypto/tls: change default minimum version to 1.2

Browse Source 
Updates the default from 1.0 -> 1.2 for servers, bringing it in line
with clients. Add a GODEBUG setting, tls10server, which lets users
revert this change.

Fixes #62459

Change-Id: I2b82f85b1c2d527df1f9afefae4ab30a8f0ceb41
Reviewed-on: https://go-review.googlesource.com/c/go/+/541516
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Damien Neil <dneil@google.com>
This commit is contained in:
yuhan6665 2024-08-18 18:30:35 -04:00
parent 48f0b2d5ed
commit f34f366b70
1 changed files with 5 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
common.go
View File

@ -746,14 +746,11 @@ type Config struct {
// MinVersion contains the minimum TLS version that is acceptable. // MinVersion contains the minimum TLS version that is acceptable.
// //
// By default, TLS 1.2 is currently used as the minimum when acting as a // By default, TLS 1.2 is currently used as the minimum. TLS 1.0 is the
// client, and TLS 1.0 when acting as a server. TLS 1.0 is the minimum // minimum supported by this package.
// supported by this package, both as a client and as a server.
// //
// The client-side default can temporarily be reverted to TLS 1.0 by // The server-side default can be reverted to TLS 1.0 by including the value
// including the value "x509sha1=1" in the GODEBUG environment variable. // "tls10server=1" in the GODEBUG environment variable.
// Note that this option will be removed in Go 1.19 (but it will still be
// possible to set this field to VersionTLS10 explicitly).
MinVersion uint16 MinVersion uint16
// MaxVersion contains the maximum TLS version that is acceptable. // MaxVersion contains the maximum TLS version that is acceptable.
@ -1059,8 +1056,7 @@ func (c *Config) supportedVersions(isClient bool) []uint16 {
if needFIPS() && (v < fipsMinVersion(c) || v > fipsMaxVersion(c)) { if needFIPS() && (v < fipsMinVersion(c) || v > fipsMaxVersion(c)) {
continue continue
} }
if (c == nil || c.MinVersion == 0) && if (c == nil || c.MinVersion == 0) && v < VersionTLS12 {
isClient && v < VersionTLS12 {
continue continue
} }
if c != nil && c.MinVersion != 0 && v < c.MinVersion { if c != nil && c.MinVersion != 0 && v < c.MinVersion {