7 files changed, 31 insertions, 44 deletions

diff --git a/src/lib/libtls/man/tls_config_set_protocols.3 b/src/lib/libtls/man/tls_config_set_protocols.3
index 7c62493e83..32b8cce757 100644
--- a/src/lib/libtls/man/tls_config_set_protocols.3
+++ b/src/lib/libtls/man/tls_config_set_protocols.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: tls_config_set_protocols.3,v 1.11 2021/01/02 19:58:44 schwarze Exp $
+.\" $OpenBSD: tls_config_set_protocols.3,v 1.12 2023/07/02 06:37:27 beck Exp $
 .\"
 .\" Copyright (c) 2014 Ted Unangst <tedu@openbsd.org>
 .\" Copyright (c) 2015, 2016 Joel Sing <jsing@openbsd.org>
@@ -16,7 +16,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: January 2 2021 $
+.Dd $Mdocdate: July 2 2023 $
 .Dt TLS_CONFIG_SET_PROTOCOLS 3
 .Os
 .Sh NAME
@@ -76,10 +76,6 @@ Possible values are the bitwise OR of:
 .Pp
 .Bl -item -offset indent -compact
 .It
-.Dv TLS_PROTOCOL_TLSv1_0
-.It
-.Dv TLS_PROTOCOL_TLSv1_1
-.It
 .Dv TLS_PROTOCOL_TLSv1_2
 .It
 .Dv TLS_PROTOCOL_TLSv1_3
@@ -87,7 +83,7 @@ Possible values are the bitwise OR of:
 .Pp
 Additionally, the values
 .Dv TLS_PROTOCOL_TLSv1
-(TLSv1.0, TLSv1.1, TLSv1.2, TLSv1.3),
+(TLSv1.2, TLSv1.3),
 .Dv TLS_PROTOCOLS_ALL
 (all supported protocols) and
 .Dv TLS_PROTOCOLS_DEFAULT
@@ -106,8 +102,6 @@ The protocol string is a comma or colon separated list of keywords.
 Valid keywords are:
 .Pp
 .Bl -tag -width "tlsv1.3" -offset indent -compact
-.It Dv tlsv1.0
-.It Dv tlsv1.1
 .It Dv tlsv1.2
 .It Dv tlsv1.3
 .It Dv all
diff --git a/src/lib/libtls/tls.c b/src/lib/libtls/tls.c
index 8444169bdc..fdb994d733 100644
--- a/src/lib/libtls/tls.c
+++ b/src/lib/libtls/tls.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls.c,v 1.97 2023/06/18 11:43:03 op Exp $ */
+/* $OpenBSD: tls.c,v 1.98 2023/07/02 06:37:27 beck Exp $ */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -520,16 +520,12 @@ tls_configure_ssl(struct tls *ctx, SSL_CTX *ssl_ctx)
 
         SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_SSLv2);
         SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_SSLv3);
+        SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_TLSv1);
+        SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_TLSv1_1);
 
-        SSL_CTX_clear_options(ssl_ctx, SSL_OP_NO_TLSv1);
-        SSL_CTX_clear_options(ssl_ctx, SSL_OP_NO_TLSv1_1);
         SSL_CTX_clear_options(ssl_ctx, SSL_OP_NO_TLSv1_2);
         SSL_CTX_clear_options(ssl_ctx, SSL_OP_NO_TLSv1_3);
 
-        if ((ctx->config->protocols & TLS_PROTOCOL_TLSv1_0) == 0)
-                SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_TLSv1);
-        if ((ctx->config->protocols & TLS_PROTOCOL_TLSv1_1) == 0)
-                SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_TLSv1_1);
         if ((ctx->config->protocols & TLS_PROTOCOL_TLSv1_2) == 0)
                 SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_TLSv1_2);
         if ((ctx->config->protocols & TLS_PROTOCOL_TLSv1_3) == 0)
diff --git a/src/lib/libtls/tls.h b/src/lib/libtls/tls.h
index b94a6fa6d0..34183745e5 100644
--- a/src/lib/libtls/tls.h
+++ b/src/lib/libtls/tls.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls.h,v 1.62 2022/03/24 15:56:34 tb Exp $ */
+/* $OpenBSD: tls.h,v 1.63 2023/07/02 06:37:27 beck Exp $ */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -29,14 +29,18 @@ extern "C" {
 
 #define TLS_API 20200120
 
-#define TLS_PROTOCOL_TLSv1_0    (1 << 1)
-#define TLS_PROTOCOL_TLSv1_1    (1 << 2)
+/*
+ * Deprecated versions of TLS. Using these effectively selects
+ * the minimum supported version.
+ */
+#define TLS_PROTOCOL_TLSv1_0    (1 << 3)
+#define TLS_PROTOCOL_TLSv1_1    (1 << 3)
+/* Supported versions of TLS */
 #define TLS_PROTOCOL_TLSv1_2    (1 << 3)
 #define TLS_PROTOCOL_TLSv1_3    (1 << 4)
 
 #define TLS_PROTOCOL_TLSv1 \
-        (TLS_PROTOCOL_TLSv1_0|TLS_PROTOCOL_TLSv1_1|\
-         TLS_PROTOCOL_TLSv1_2|TLS_PROTOCOL_TLSv1_3)
+        (TLS_PROTOCOL_TLSv1_2|TLS_PROTOCOL_TLSv1_3)
 
 #define TLS_PROTOCOLS_ALL TLS_PROTOCOL_TLSv1
 #define TLS_PROTOCOLS_DEFAULT (TLS_PROTOCOL_TLSv1_2|TLS_PROTOCOL_TLSv1_3)
diff --git a/src/lib/libtls/tls_config.c b/src/lib/libtls/tls_config.c
index 3efd0ddd57..5eb5b69ac6 100644
--- a/src/lib/libtls/tls_config.c
+++ b/src/lib/libtls/tls_config.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls_config.c,v 1.66 2023/05/14 07:26:25 op Exp $ */
+/* $OpenBSD: tls_config.c,v 1.67 2023/07/02 06:37:27 beck Exp $ */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -251,9 +251,9 @@ tls_config_parse_protocols(uint32_t *protocols, const char *protostr)
                 if (strcasecmp(p, "tlsv1") == 0)
                         proto = TLS_PROTOCOL_TLSv1;
                 else if (strcasecmp(p, "tlsv1.0") == 0)
-                        proto = TLS_PROTOCOL_TLSv1_0;
+                        proto = TLS_PROTOCOL_TLSv1_2;
                 else if (strcasecmp(p, "tlsv1.1") == 0)
-                        proto = TLS_PROTOCOL_TLSv1_1;
+                        proto = TLS_PROTOCOL_TLSv1_2;
                 else if (strcasecmp(p, "tlsv1.2") == 0)
                         proto = TLS_PROTOCOL_TLSv1_2;
                 else if (strcasecmp(p, "tlsv1.3") == 0)
diff --git a/src/regress/lib/libtls/config/configtest.c b/src/regress/lib/libtls/config/configtest.c
index 47aa03e826..5af5b56ffd 100644
--- a/src/regress/lib/libtls/config/configtest.c
+++ b/src/regress/lib/libtls/config/configtest.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: configtest.c,v 1.2 2020/01/20 08:40:16 jsing Exp $ */
+/* $OpenBSD: configtest.c,v 1.3 2023/07/02 06:37:27 beck Exp $ */
 /*
  * Copyright (c) 2017 Joel Sing <jsing@openbsd.org>
  *
@@ -71,30 +71,27 @@ struct parse_protocols_test parse_protocols_tests[] = {
         {
                 .protostr = "tlsv1.0:tlsv1.1:tlsv1.2:tlsv1.3",
                 .want_return = 0,
-                .want_protocols = TLS_PROTOCOL_TLSv1_0 | TLS_PROTOCOL_TLSv1_1 |
-                    TLS_PROTOCOL_TLSv1_2 | TLS_PROTOCOL_TLSv1_3,
+                .want_protocols = TLS_PROTOCOL_TLSv1_2 | TLS_PROTOCOL_TLSv1_3,
         },
         {
                 .protostr = "tlsv1.0,tlsv1.1,tlsv1.2,tlsv1.3",
                 .want_return = 0,
-                .want_protocols = TLS_PROTOCOL_TLSv1_0 | TLS_PROTOCOL_TLSv1_1 |
-                    TLS_PROTOCOL_TLSv1_2 | TLS_PROTOCOL_TLSv1_3,
+                .want_protocols = TLS_PROTOCOL_TLSv1_2 | TLS_PROTOCOL_TLSv1_3,
         },
         {
                 .protostr = "tlsv1.1,tlsv1.2,tlsv1.0",
                 .want_return = 0,
-                .want_protocols = TLS_PROTOCOL_TLSv1_0 | TLS_PROTOCOL_TLSv1_1 |
-                    TLS_PROTOCOL_TLSv1_2,
+                .want_protocols = TLS_PROTOCOL_TLSv1_2,
         },
         {
                 .protostr = "tlsv1.1,tlsv1.2,tlsv1.1",
                 .want_return = 0,
-                .want_protocols = TLS_PROTOCOL_TLSv1_1 | TLS_PROTOCOL_TLSv1_2,
+                .want_protocols = TLS_PROTOCOL_TLSv1_2,
         },
         {
                 .protostr = "tlsv1.1,tlsv1.2,!tlsv1.1",
                 .want_return = 0,
-                .want_protocols = TLS_PROTOCOL_TLSv1_2,
+                .want_protocols = 0,
         },
         {
                 .protostr = "unknown",
@@ -114,19 +111,17 @@ struct parse_protocols_test parse_protocols_tests[] = {
         {
                 .protostr = "all,!tlsv1.0",
                 .want_return = 0,
-                .want_protocols = TLS_PROTOCOL_TLSv1_1 | TLS_PROTOCOL_TLSv1_2 | \
-                        TLS_PROTOCOL_TLSv1_3,
+                .want_protocols = TLS_PROTOCOL_TLSv1_3,
         },
         {
                 .protostr = "!tlsv1.0",
                 .want_return = 0,
-                .want_protocols = TLS_PROTOCOL_TLSv1_1 | TLS_PROTOCOL_TLSv1_2 | \
-                        TLS_PROTOCOL_TLSv1_3,
+                .want_protocols = TLS_PROTOCOL_TLSv1_3,
         },
         {
                 .protostr = "!tlsv1.0,!tlsv1.1,!tlsv1.3",
                 .want_return = 0,
-                .want_protocols = TLS_PROTOCOL_TLSv1_2,
+                .want_protocols = 0,
         },
         {
                 .protostr = "!tlsv1.0,!tlsv1.1,tlsv1.2,!tlsv1.3",
diff --git a/src/regress/lib/libtls/gotls/tls.go b/src/regress/lib/libtls/gotls/tls.go
index cf3e84c030..3029d58c35 100644
--- a/src/regress/lib/libtls/gotls/tls.go
+++ b/src/regress/lib/libtls/gotls/tls.go
@@ -45,8 +45,6 @@ const (
 )
 
 var protocolNames = map[ProtocolVersion]string{
-        ProtocolTLSv10: "TLSv1",
-        ProtocolTLSv11: "TLSv1.1",
         ProtocolTLSv12: "TLSv1.2",
         ProtocolTLSv13: "TLSv1.3",
         ProtocolsAll:   "all",
diff --git a/src/regress/lib/libtls/gotls/tls_test.go b/src/regress/lib/libtls/gotls/tls_test.go
index f6c6cfcdd5..2b7ce2c19e 100644
--- a/src/regress/lib/libtls/gotls/tls_test.go
+++ b/src/regress/lib/libtls/gotls/tls_test.go
@@ -251,11 +251,11 @@ func TestTLSVersions(t *testing.T) {
                 {tls.VersionSSL30, tls.VersionTLS12, ProtocolTLSv12, false},
                 {tls.VersionTLS10, tls.VersionTLS12, ProtocolTLSv12, false},
                 {tls.VersionTLS11, tls.VersionTLS12, ProtocolTLSv12, false},
-                {tls.VersionSSL30, tls.VersionTLS11, ProtocolTLSv11, false},
-                {tls.VersionSSL30, tls.VersionTLS10, ProtocolTLSv10, false},
+                {tls.VersionSSL30, tls.VersionTLS11, ProtocolTLSv11, true},
+                {tls.VersionSSL30, tls.VersionTLS10, ProtocolTLSv10, true},
                 {tls.VersionSSL30, tls.VersionSSL30, 0, true},
-                {tls.VersionTLS10, tls.VersionTLS10, ProtocolTLSv10, false},
-                {tls.VersionTLS11, tls.VersionTLS11, ProtocolTLSv11, false},
+                {tls.VersionTLS10, tls.VersionTLS10, ProtocolTLSv10, true},
+                {tls.VersionTLS11, tls.VersionTLS11, ProtocolTLSv11, true},
                 {tls.VersionTLS12, tls.VersionTLS12, ProtocolTLSv12, false},
         }
         for i, test := range tests {