From 365c5d1d4835631a61fbad05a86ee8ce9489aa1f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabian=20Gr=C3=BCnbichler?= Date: Wed, 19 Jul 2023 11:15:55 +0200 Subject: [PATCH] fix #4859: properly configure TLSv1.3 only mode MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit set_min/max_proto_version is recommended upstream nowadays, and it seems to be required for some reason if *only* TLS v1.3 is supposed to be enabled. querying via get_options gives us the union of - system-wide openssl defaults - our internal SSL defaults - flags configured by the user via /etc/default/pveproxy note that by default only 1.2 and 1.3 are enabled in the first place, so disabling either leaves a single version being set as min and max. Signed-off-by: Fabian Grünbichler --- src/PVE/APIServer/AnyEvent.pm | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/src/PVE/APIServer/AnyEvent.pm b/src/PVE/APIServer/AnyEvent.pm index e34c06a..cebd9ba 100644 --- a/src/PVE/APIServer/AnyEvent.pm +++ b/src/PVE/APIServer/AnyEvent.pm @@ -2012,6 +2012,23 @@ sub new { warn "Failed to set TLS 1.3 ciphersuites '$ciphersuites'\n" if !Net::SSLeay::CTX_set_ciphersuites($self->{tls_ctx}->{ctx}, $ciphersuites); } + + my $opts = Net::SSLeay::CTX_get_options($self->{tls_ctx}->{ctx}); + my $min_version = Net::SSLeay::TLS1_1_VERSION(); + my $max_version = Net::SSLeay::TLS1_3_VERSION(); + if ($opts & &Net::SSLeay::OP_NO_TLSv1_1) { + $min_version = Net::SSLeay::TLS1_2_VERSION(); + } + if ($opts & &Net::SSLeay::OP_NO_TLSv1_2) { + $min_version = Net::SSLeay::TLS1_3_VERSION(); + } + if ($opts & &Net::SSLeay::OP_NO_TLSv1_3) { + die "misconfigured TLS settings - cannot disable all supported TLS versions!\n" + if $min_version && $min_version == Net::SSLeay::TLS1_3_VERSION(); + $max_version = Net::SSLeay::TLS1_2_VERSION(); + } + Net::SSLeay::CTX_set_min_proto_version($self->{tls_ctx}->{ctx}, $min_version) if $min_version; + Net::SSLeay::CTX_set_max_proto_version($self->{tls_ctx}->{ctx}, $max_version); } if ($self->{spiceproxy}) {