fedserv/echoIRCd
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

tls: rustls backend offers TLS 1.3 (was TLS 1.2 only), preferred over 1.2

Browse source
This commit is contained in:
Jean Chevronnet 2026-08-24 20:30:54 +00:00
parent d0fdb2e8be
commit 51602737e2
No known key found for this signature in database
GPG key ID: 439666D63A9477E4
1 changed files with 5 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

10
src/tls_rustls.rs
View file

@ -163,12 +163,12 @@ fn build_config(
let verifier = Arc::new(AcceptAnyClientCert { let verifier = Arc::new(AcceptAnyClientCert {
provider: provider.clone(), provider: provider.clone(),
}); });
// Mirror the openssl backend's version policy (mozilla_intermediate = TLS 1.2) // Offer TLS 1.3 (preferred) and TLS 1.2. Modern clients land on 1.3 with an AEAD
// so rustls is a true drop-in: every client negotiates the same protocol it did // suite (AES-GCM / ChaCha20-Poly1305); older clients fall back to 1.2 ECDHE-AEAD.
// on openssl. Offering 1.3 here pushed clients onto a 1.3 handshake openssl never // The post-quantum X25519MLKEM768 key-exchange group needs the aws-lc-rs provider
// served, and some couldn't complete it. // (the ring provider has no ML-KEM); the openssl backend already offers it.
let cfg = ServerConfig::builder_with_provider(provider.clone()) let cfg = ServerConfig::builder_with_provider(provider.clone())
.with_protocol_versions(&[&rustls::version::TLS12]) .with_protocol_versions(&[&rustls::version::TLS13, &rustls::version::TLS12])
.map_err(err)? .map_err(err)?
.with_client_cert_verifier(verifier) .with_client_cert_verifier(verifier)
.with_cert_resolver(resolver); .with_cert_resolver(resolver);