romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-24 15:27:22 +03:00
Code Issues Projects Releases Packages Wiki Activity

quic: fix min TLS version handling

Browse source 
When switching to TSLv1.2 as default in
9d8998c994, this led to an explicit
setting of 1.2 on QUIC connections when using quictls, overriding the
already set min version of 1.3.

This leads to a ClientHello with TLS 1.2+1.3 offered on a QUIC connect
which is rejected by the Caddy server. Using ngtcp2 with OpenSSL 3.5+,
GnuTLS or AWS-LC is not affected.

Fixes #18518
Reported-by: fds242 on github
Closes #18520
This commit is contained in:
Stefan Eissing 2025-09-11 12:59:22 +02:00 • committed by Daniel Stenberg
parent bf6ae59ab1
commit b178d58266
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 4 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

7
lib/vtls/openssl.c
View file

@ -2865,11 +2865,12 @@ static void ossl_trace(int direction, int ssl_ver, int content_type,
#if OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 */
static CURLcode
ossl_set_ssl_version_min_max(struct Curl_cfilter *cf, SSL_CTX *ctx)
ossl_set_ssl_version_min_max(struct Curl_cfilter *cf, SSL_CTX *ctx,
unsigned int ssl_version_min)
{
struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
/* first, TLS min version... */
long curl_ssl_version_min = conn_config->version;
long curl_ssl_version_min = (long)ssl_version_min;
long curl_ssl_version_max;
/* convert curl min SSL version option to OpenSSL constant */
@ -4110,7 +4111,7 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
ctx_options |= SSL_OP_NO_SSLv3;
#if OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 */
result = ossl_set_ssl_version_min_max(cf, octx->ssl_ctx);
result = ossl_set_ssl_version_min_max(cf, octx->ssl_ctx, ssl_version_min);
#else
result = ossl_set_ssl_version_min_max_legacy(&ctx_options, cf, data);
#endif