From ddcb4efd6551a982bf29b2e8e83c9c808a1670dc Mon Sep 17 00:00:00 2001
From: beck <>
Date: Sun, 2 Jul 2023 17:21:33 +0000
Subject: Disable TLS 1.0 and TLS 1.1 in libssl

Their time has long since past, and they should not be used.
This change restricts ssl to versions 1.2 and 1.3, and changes
the regression tests to understand we no longer speak the legacy
protocols.

For the moment the magical "golden" byte for byte comparison
tests of raw handshake values are disabled util jsing fixes them.

ok jsing@ tb@
---
 src/regress/lib/libssl/tls/tlstest.c | 78 +-----------------------------------
 1 file changed, 1 insertion(+), 77 deletions(-)

(limited to 'src/regress/lib/libssl/tls/tlstest.c')

diff --git a/src/regress/lib/libssl/tls/tlstest.c b/src/regress/lib/libssl/tls/tlstest.c
index 5c72717e6e..8154e7576c 100644
--- a/src/regress/lib/libssl/tls/tlstest.c
+++ b/src/regress/lib/libssl/tls/tlstest.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tlstest.c,v 1.1 2021/10/23 14:34:10 jsing Exp $ */
+/* $OpenBSD: tlstest.c,v 1.2 2023/07/02 17:21:33 beck Exp $ */
 /*
  * Copyright (c) 2020, 2021 Joel Sing <jsing@openbsd.org>
  *
@@ -244,14 +244,6 @@ static const struct tls_test tls_tests[] = {
 		.desc = "Default client and TLSv1.2 server",
 		.server_max_version = TLS1_2_VERSION,
 	},
-	{
-		.desc = "Default client and TLSv1.1 server",
-		.server_max_version = TLS1_1_VERSION,
-	},
-	{
-		.desc = "Default client and TLSv1.0 server",
-		.server_max_version = TLS1_VERSION,
-	},
 	{
 		.desc = "Default client and default server with ECDHE KEX",
 		.server_ciphers = "ECDHE-RSA-AES128-SHA",
@@ -261,16 +253,6 @@ static const struct tls_test tls_tests[] = {
 		.server_max_version = TLS1_2_VERSION,
 		.server_ciphers = "ECDHE-RSA-AES128-SHA",
 	},
-	{
-		.desc = "Default client and TLSv1.1 server with ECDHE KEX",
-		.server_max_version = TLS1_1_VERSION,
-		.server_ciphers = "ECDHE-RSA-AES128-SHA",
-	},
-	{
-		.desc = "Default client and TLSv1.0 server with ECDHE KEX",
-		.server_max_version = TLS1_VERSION,
-		.server_ciphers = "ECDHE-RSA-AES128-SHA",
-	},
 	{
 		.desc = "Default client and default server with DHE KEX",
 		.server_ciphers = "DHE-RSA-AES128-SHA",
@@ -280,16 +262,6 @@ static const struct tls_test tls_tests[] = {
 		.server_max_version = TLS1_2_VERSION,
 		.server_ciphers = "DHE-RSA-AES128-SHA",
 	},
-	{
-		.desc = "Default client and TLSv1.1 server with DHE KEX",
-		.server_max_version = TLS1_1_VERSION,
-		.server_ciphers = "DHE-RSA-AES128-SHA",
-	},
-	{
-		.desc = "Default client and TLSv1.0 server with DHE KEX",
-		.server_max_version = TLS1_VERSION,
-		.server_ciphers = "DHE-RSA-AES128-SHA",
-	},
 	{
 		.desc = "Default client and default server with RSA KEX",
 		.server_ciphers = "AES128-SHA",
@@ -299,73 +271,25 @@ static const struct tls_test tls_tests[] = {
 		.server_max_version = TLS1_2_VERSION,
 		.server_ciphers = "AES128-SHA",
 	},
-	{
-		.desc = "Default client and TLSv1.1 server with RSA KEX",
-		.server_max_version = TLS1_1_VERSION,
-		.server_ciphers = "AES128-SHA",
-	},
-	{
-		.desc = "Default client and TLSv1.0 server with RSA KEX",
-		.server_max_version = TLS1_VERSION,
-		.server_ciphers = "AES128-SHA",
-	},
 	{
 		.desc = "TLSv1.2 client and default server",
 		.client_max_version = TLS1_2_VERSION,
 	},
-	{
-		.desc = "TLSv1.1 client and default server",
-		.client_max_version = TLS1_1_VERSION,
-	},
-	{
-		.desc = "TLSv1.0 client and default server",
-		.client_max_version = TLS1_VERSION,
-	},
 	{
 		.desc = "TLSv1.2 client and default server with ECDHE KEX",
 		.client_max_version = TLS1_2_VERSION,
 		.client_ciphers = "ECDHE-RSA-AES128-SHA",
 	},
-	{
-		.desc = "TLSv1.1 client and default server with ECDHE KEX",
-		.client_max_version = TLS1_1_VERSION,
-		.client_ciphers = "ECDHE-RSA-AES128-SHA",
-	},
-	{
-		.desc = "TLSv1.0 client and default server with ECDHE KEX",
-		.client_max_version = TLS1_VERSION,
-		.client_ciphers = "ECDHE-RSA-AES128-SHA",
-	},
 	{
 		.desc = "TLSv1.2 client and default server with DHE KEX",
 		.server_max_version = TLS1_2_VERSION,
 		.client_ciphers = "DHE-RSA-AES128-SHA",
 	},
-	{
-		.desc = "TLSv1.1 client and default server with DHE KEX",
-		.client_max_version = TLS1_1_VERSION,
-		.client_ciphers = "DHE-RSA-AES128-SHA",
-	},
-	{
-		.desc = "TLSv1.0 client and default server with DHE KEX",
-		.client_max_version = TLS1_VERSION,
-		.client_ciphers = "DHE-RSA-AES128-SHA",
-	},
 	{
 		.desc = "TLSv1.2 client and default server with RSA KEX",
 		.client_max_version = TLS1_2_VERSION,
 		.client_ciphers = "AES128-SHA",
 	},
-	{
-		.desc = "TLSv1.1 client and default server with RSA KEX",
-		.client_max_version = TLS1_1_VERSION,
-		.client_ciphers = "AES128-SHA",
-	},
-	{
-		.desc = "TLSv1.0 client and default server with RSA KEX",
-		.client_max_version = TLS1_VERSION,
-		.client_ciphers = "AES128-SHA",
-	},
 };
 
 #define N_TLS_TESTS (sizeof(tls_tests) / sizeof(*tls_tests))
-- 
cgit v1.2.3-55-g6feb