libtls: fix legacy protocol parsing
authortb <tb@openbsd.org>
Fri, 2 Aug 2024 15:00:01 +0000 (15:00 +0000)
committertb <tb@openbsd.org>
Fri, 2 Aug 2024 15:00:01 +0000 (15:00 +0000)
commit6a16e2b38b4c2329e78053486be431a1ce8bddf5
tree0ef85268dd89bdc8d31bdb2e2e2906189fe8527b
parent953cd95b0244a79c6c1af0894b02de3d6c3a9472
libtls: fix legacy protocol parsing

Redefining TLS_PROTOCOL_TLSv1_0 and TLS_PROTOCOL_TLSv1_1 to be the same
as TLS_PROTOCOL_TLSv1_2 had undesired side effects, as witnessed in the
accompanying regress tests. The protocol string all:tlsv1.0 would disable
TLSv1.2 (so only enable TLSv1.3) and tlsv1.2:!tlsv1.1 would disable all
protocols.

It makes more sense to ignore any setting of TLSv1.0 and TLSv1.1, so if
you request 'tlsv1.1' you get no protocol, but 'all:!tlsv1.1' will enable
the two supported protocols TLSv1.3 and TLSv1.2.

Restore the defines to their original values and adjust the parsing code
to set/unset them.

Issue reported by Kenjiro Nakayama
Fixes https://github.com/libressl/openbsd/issues/151

with/ok jsing
lib/libtls/tls.h
lib/libtls/tls_config.c