From 9ea343cf6ccda35b4aa4c4e74dd80b7a59029076 Mon Sep 17 00:00:00 2001 From: jsing <> Date: Mon, 20 Jan 2020 08:39:21 +0000 Subject: Add support for TLSv1.3 as a protocol to libtls. This makes tls_config_parse_protocols() recognise and handle "tlsv1.3". If TLSv1.3 is enabled libtls will also request libssl to enable it. ok beck@ tb@ --- src/lib/libtls/man/tls_config_set_protocols.3 | 13 +++++++------ src/lib/libtls/tls.c | 5 ++++- src/lib/libtls/tls.h | 9 ++++++--- src/lib/libtls/tls_config.c | 4 +++- 4 files changed, 20 insertions(+), 11 deletions(-) (limited to 'src/lib') diff --git a/src/lib/libtls/man/tls_config_set_protocols.3 b/src/lib/libtls/man/tls_config_set_protocols.3 index 4f5c91a3f0..ec913827c2 100644 --- a/src/lib/libtls/man/tls_config_set_protocols.3 +++ b/src/lib/libtls/man/tls_config_set_protocols.3 @@ -1,4 +1,4 @@ -.\" $OpenBSD: tls_config_set_protocols.3,v 1.6 2017/08/12 04:24:49 jsing Exp $ +.\" $OpenBSD: tls_config_set_protocols.3,v 1.7 2020/01/20 08:39:21 jsing Exp $ .\" .\" Copyright (c) 2014 Ted Unangst .\" Copyright (c) 2015, 2016 Joel Sing @@ -16,7 +16,7 @@ .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" -.Dd $Mdocdate: August 12 2017 $ +.Dd $Mdocdate: January 20 2020 $ .Dt TLS_CONFIG_SET_PROTOCOLS 3 .Os .Sh NAME @@ -78,11 +78,12 @@ Possible values are the bitwise OR of: .It Dv TLS_PROTOCOL_TLSv1_0 .It Dv TLS_PROTOCOL_TLSv1_1 .It Dv TLS_PROTOCOL_TLSv1_2 +.It Dv TLS_PROTOCOL_TLSv1_3 .El .Pp Additionally, the values .Dv TLS_PROTOCOL_TLSv1 -(TLSv1.0, TLSv1.1 and TLSv1.2), +(TLSv1.0, TLSv1.1, TLSv1.2, TLSv1.3), .Dv TLS_PROTOCOLS_ALL (all supported protocols) and .Dv TLS_PROTOCOLS_DEFAULT @@ -98,9 +99,9 @@ This value can then be passed to the .Fn tls_config_set_protocols function. The protocol string is a comma or colon separated list of keywords. -Valid keywords are tlsv1.0, tlsv1.1, tlsv1.2, all (all supported protocols), -default (an alias for secure), legacy (an alias for all) and secure (currently -TLSv1.2 only). +Valid keywords are tlsv1.0, tlsv1.1, tlsv1.2, tlsv1.3, all (all supported +protocols), default (an alias for secure), legacy (an alias for all) and +secure (currently TLSv1.2 only). If a value has a negative prefix (in the form of a leading exclamation mark) then it is removed from the list of available protocols, rather than being added to it. diff --git a/src/lib/libtls/tls.c b/src/lib/libtls/tls.c index 46ed8180d1..1931f4838a 100644 --- a/src/lib/libtls/tls.c +++ b/src/lib/libtls/tls.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tls.c,v 1.83 2019/04/01 15:58:02 jsing Exp $ */ +/* $OpenBSD: tls.c,v 1.84 2020/01/20 08:39:21 jsing Exp $ */ /* * Copyright (c) 2014 Joel Sing * @@ -414,6 +414,7 @@ tls_configure_ssl(struct tls *ctx, SSL_CTX *ssl_ctx) SSL_CTX_clear_options(ssl_ctx, SSL_OP_NO_TLSv1); SSL_CTX_clear_options(ssl_ctx, SSL_OP_NO_TLSv1_1); SSL_CTX_clear_options(ssl_ctx, SSL_OP_NO_TLSv1_2); + SSL_CTX_clear_options(ssl_ctx, SSL_OP_NO_TLSv1_3); if ((ctx->config->protocols & TLS_PROTOCOL_TLSv1_0) == 0) SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_TLSv1); @@ -421,6 +422,8 @@ tls_configure_ssl(struct tls *ctx, SSL_CTX *ssl_ctx) SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_TLSv1_1); if ((ctx->config->protocols & TLS_PROTOCOL_TLSv1_2) == 0) SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_TLSv1_2); + if ((ctx->config->protocols & TLS_PROTOCOL_TLSv1_3) == 0) + SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_TLSv1_3); if (ctx->config->alpn != NULL) { if (SSL_CTX_set_alpn_protos(ssl_ctx, ctx->config->alpn, diff --git a/src/lib/libtls/tls.h b/src/lib/libtls/tls.h index fee60c7cc8..59e1aac49b 100644 --- a/src/lib/libtls/tls.h +++ b/src/lib/libtls/tls.h @@ -1,4 +1,4 @@ -/* $OpenBSD: tls.h,v 1.56 2019/11/02 13:37:59 jsing Exp $ */ +/* $OpenBSD: tls.h,v 1.57 2020/01/20 08:39:21 jsing Exp $ */ /* * Copyright (c) 2014 Joel Sing * @@ -27,13 +27,16 @@ extern "C" { #include #include -#define TLS_API 20180210 +#define TLS_API 20200120 #define TLS_PROTOCOL_TLSv1_0 (1 << 1) #define TLS_PROTOCOL_TLSv1_1 (1 << 2) #define TLS_PROTOCOL_TLSv1_2 (1 << 3) +#define TLS_PROTOCOL_TLSv1_3 (1 << 4) + #define TLS_PROTOCOL_TLSv1 \ - (TLS_PROTOCOL_TLSv1_0|TLS_PROTOCOL_TLSv1_1|TLS_PROTOCOL_TLSv1_2) + (TLS_PROTOCOL_TLSv1_0|TLS_PROTOCOL_TLSv1_1|\ + TLS_PROTOCOL_TLSv1_2|TLS_PROTOCOL_TLSv1_3) #define TLS_PROTOCOLS_ALL TLS_PROTOCOL_TLSv1 #define TLS_PROTOCOLS_DEFAULT TLS_PROTOCOL_TLSv1_2 diff --git a/src/lib/libtls/tls_config.c b/src/lib/libtls/tls_config.c index 424fd73c93..ed47170835 100644 --- a/src/lib/libtls/tls_config.c +++ b/src/lib/libtls/tls_config.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tls_config.c,v 1.57 2019/11/16 06:44:33 beck Exp $ */ +/* $OpenBSD: tls_config.c,v 1.58 2020/01/20 08:39:21 jsing Exp $ */ /* * Copyright (c) 2014 Joel Sing * @@ -253,6 +253,8 @@ tls_config_parse_protocols(uint32_t *protocols, const char *protostr) proto = TLS_PROTOCOL_TLSv1_1; else if (strcasecmp(p, "tlsv1.2") == 0) proto = TLS_PROTOCOL_TLSv1_2; + else if (strcasecmp(p, "tlsv1.3") == 0) + proto = TLS_PROTOCOL_TLSv1_3; if (proto == 0) { free(s); -- cgit v1.2.3-55-g6feb