4 files changed, 20 insertions, 11 deletions

diff --git a/src/lib/libtls/man/tls_config_set_protocols.3 b/src/lib/libtls/man/tls_config_set_protocols.3
index 4f5c91a3f0..ec913827c2 100644
--- a/src/lib/libtls/man/tls_config_set_protocols.3
+++ b/src/lib/libtls/man/tls_config_set_protocols.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: tls_config_set_protocols.3,v 1.6 2017/08/12 04:24:49 jsing Exp $
+.\" $OpenBSD: tls_config_set_protocols.3,v 1.7 2020/01/20 08:39:21 jsing Exp $
 .\"
 .\" Copyright (c) 2014 Ted Unangst <tedu@openbsd.org>
 .\" Copyright (c) 2015, 2016 Joel Sing <jsing@openbsd.org>
@@ -16,7 +16,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: August 12 2017 $
+.Dd $Mdocdate: January 20 2020 $
 .Dt TLS_CONFIG_SET_PROTOCOLS 3
 .Os
 .Sh NAME
@@ -78,11 +78,12 @@ Possible values are the bitwise OR of:
 .It Dv TLS_PROTOCOL_TLSv1_0
 .It Dv TLS_PROTOCOL_TLSv1_1
 .It Dv TLS_PROTOCOL_TLSv1_2
+.It Dv TLS_PROTOCOL_TLSv1_3
 .El
 .Pp
 Additionally, the values
 .Dv TLS_PROTOCOL_TLSv1
-(TLSv1.0, TLSv1.1 and TLSv1.2),
+(TLSv1.0, TLSv1.1, TLSv1.2, TLSv1.3),
 .Dv TLS_PROTOCOLS_ALL
 (all supported protocols) and
 .Dv TLS_PROTOCOLS_DEFAULT
@@ -98,9 +99,9 @@ This value can then be passed to the
 .Fn tls_config_set_protocols
 function.
 The protocol string is a comma or colon separated list of keywords.
-Valid keywords are tlsv1.0, tlsv1.1, tlsv1.2, all (all supported protocols),
-default (an alias for secure), legacy (an alias for all) and secure (currently
-TLSv1.2 only).
+Valid keywords are tlsv1.0, tlsv1.1, tlsv1.2, tlsv1.3, all (all supported
+protocols), default (an alias for secure), legacy (an alias for all) and
+secure (currently TLSv1.2 only).
 If a value has a negative prefix (in the form of a leading exclamation mark)
 then it is removed from the list of available protocols, rather than being
 added to it.
diff --git a/src/lib/libtls/tls.c b/src/lib/libtls/tls.c
index 46ed8180d1..1931f4838a 100644
--- a/src/lib/libtls/tls.c
+++ b/src/lib/libtls/tls.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls.c,v 1.83 2019/04/01 15:58:02 jsing Exp $ */
+/* $OpenBSD: tls.c,v 1.84 2020/01/20 08:39:21 jsing Exp $ */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -414,6 +414,7 @@ tls_configure_ssl(struct tls *ctx, SSL_CTX *ssl_ctx)
         SSL_CTX_clear_options(ssl_ctx, SSL_OP_NO_TLSv1);
         SSL_CTX_clear_options(ssl_ctx, SSL_OP_NO_TLSv1_1);
         SSL_CTX_clear_options(ssl_ctx, SSL_OP_NO_TLSv1_2);
+        SSL_CTX_clear_options(ssl_ctx, SSL_OP_NO_TLSv1_3);
 
         if ((ctx->config->protocols & TLS_PROTOCOL_TLSv1_0) == 0)
                 SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_TLSv1);
@@ -421,6 +422,8 @@ tls_configure_ssl(struct tls *ctx, SSL_CTX *ssl_ctx)
                 SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_TLSv1_1);
         if ((ctx->config->protocols & TLS_PROTOCOL_TLSv1_2) == 0)
                 SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_TLSv1_2);
+        if ((ctx->config->protocols & TLS_PROTOCOL_TLSv1_3) == 0)
+                SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_TLSv1_3);
 
         if (ctx->config->alpn != NULL) {
                 if (SSL_CTX_set_alpn_protos(ssl_ctx, ctx->config->alpn,
diff --git a/src/lib/libtls/tls.h b/src/lib/libtls/tls.h
index fee60c7cc8..59e1aac49b 100644
--- a/src/lib/libtls/tls.h
+++ b/src/lib/libtls/tls.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls.h,v 1.56 2019/11/02 13:37:59 jsing Exp $ */
+/* $OpenBSD: tls.h,v 1.57 2020/01/20 08:39:21 jsing Exp $ */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -27,13 +27,16 @@ extern "C" {
 #include <stddef.h>
 #include <stdint.h>
 
-#define TLS_API 20180210
+#define TLS_API 20200120
 
 #define TLS_PROTOCOL_TLSv1_0    (1 << 1)
 #define TLS_PROTOCOL_TLSv1_1    (1 << 2)
 #define TLS_PROTOCOL_TLSv1_2    (1 << 3)
+#define TLS_PROTOCOL_TLSv1_3    (1 << 4)
+
 #define TLS_PROTOCOL_TLSv1 \
-        (TLS_PROTOCOL_TLSv1_0|TLS_PROTOCOL_TLSv1_1|TLS_PROTOCOL_TLSv1_2)
+        (TLS_PROTOCOL_TLSv1_0|TLS_PROTOCOL_TLSv1_1|\
+         TLS_PROTOCOL_TLSv1_2|TLS_PROTOCOL_TLSv1_3)
 
 #define TLS_PROTOCOLS_ALL TLS_PROTOCOL_TLSv1
 #define TLS_PROTOCOLS_DEFAULT TLS_PROTOCOL_TLSv1_2
diff --git a/src/lib/libtls/tls_config.c b/src/lib/libtls/tls_config.c
index 424fd73c93..ed47170835 100644
--- a/src/lib/libtls/tls_config.c
+++ b/src/lib/libtls/tls_config.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls_config.c,v 1.57 2019/11/16 06:44:33 beck Exp $ */
+/* $OpenBSD: tls_config.c,v 1.58 2020/01/20 08:39:21 jsing Exp $ */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -253,6 +253,8 @@ tls_config_parse_protocols(uint32_t *protocols, const char *protostr)
                         proto = TLS_PROTOCOL_TLSv1_1;
                 else if (strcasecmp(p, "tlsv1.2") == 0)
                         proto = TLS_PROTOCOL_TLSv1_2;
+                else if (strcasecmp(p, "tlsv1.3") == 0)
+                        proto = TLS_PROTOCOL_TLSv1_3;
 
                 if (proto == 0) {
                         free(s);