Commit 6aab6386 authored by Charlie Li's avatar Charlie Li
Browse files

Use LibreSSL's preferred method of only allowing TLSv1.3

parent 4f0d5bfe

openssl/src/ssl/connector.rs

+5 −0
Original line number Diff line number Diff line
@@ -4,6 +4,8 @@ use std::ops::{Deref, DerefMut}; 


use crate::dh::Dh;

use crate::error::ErrorStack;

#[cfg(libressl340)]

use crate::ssl::SslVersion;

use crate::ssl::{

    HandshakeError, Ssl, SslContext, SslContextBuilder, SslContextRef, SslMethod, SslMode,

    SslOptions, SslRef, SslStream, SslVerifyMode,
@@ -253,7 +255,10 @@ impl SslAcceptor { 
    #[cfg(any(ossl111, libressl340))]

    pub fn mozilla_modern_v5(method: SslMethod) -> Result<SslAcceptorBuilder, ErrorStack> {

        let mut ctx = ctx(method)?;

        #[cfg(ossl111)]

        ctx.set_options(SslOptions::NO_SSL_MASK & !SslOptions::NO_TLSV1_3);

        #[cfg(libressl340)]

        ctx.set_min_proto_version(Some(SslVersion::TLS1_3))?;

        ctx.set_ciphersuites(

            "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256",

        )?;