fedserv/echoIRCd
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

rustls: offer TLS 1.2 only, matching the openssl backend (mozilla_intermediate) — advertising 1.3 as well pushed every client onto a 1.3 handshake openssl never served, so a client fine on 1.2 could fail to connect; a drop-in backend must negotiate the same protocol

Browse source
This commit is contained in:
Jean Chevronnet 2026-08-19 17:55:31 +00:00
parent 598a019620
commit f1ddb878af
No known key found for this signature in database
GPG key ID: 439666D63A9477E4
1 changed files with 5 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/tls_rustls.rs
View file

@ -163,8 +163,12 @@ fn build_config(
let verifier = Arc::new(AcceptAnyClientCert { let verifier = Arc::new(AcceptAnyClientCert {
provider: provider.clone(), provider: provider.clone(),
}); });
// Mirror the openssl backend's version policy (mozilla_intermediate = TLS 1.2)
// so rustls is a true drop-in: every client negotiates the same protocol it did
// on openssl. Offering 1.3 here pushed clients onto a 1.3 handshake openssl never
// served, and some couldn't complete it.
let cfg = ServerConfig::builder_with_provider(provider.clone()) let cfg = ServerConfig::builder_with_provider(provider.clone())
.with_protocol_versions(rustls::ALL_VERSIONS) .with_protocol_versions(&[&rustls::version::TLS12])
.map_err(err)? .map_err(err)?
.with_client_cert_verifier(verifier) .with_client_cert_verifier(verifier)
.with_cert_resolver(resolver); .with_cert_resolver(resolver);