Skip to content

Commit

Permalink
tls: remove support for TLS 1.0 and 1.1.
Browse files Browse the repository at this point in the history
Those old algorithms are not used anywhere, and are not recommended.
TLS 1.2 support has been prevalent for over a decade.
  • Loading branch information
gdamore committed Nov 16, 2024
1 parent 9ecd18c commit f93efef
Show file tree
Hide file tree
Showing 2 changed files with 2 additions and 29 deletions.
25 changes: 2 additions & 23 deletions src/supplemental/tls/mbedtls/tls.c
Original file line number Diff line number Diff line change
Expand Up @@ -467,9 +467,8 @@ config_init(nng_tls_engine_config *cfg, enum nng_tls_mode mode)

mbedtls_ssl_conf_authmode(&cfg->cfg_ctx, auth_mode);

// Default: we *require* TLS v1.2 or newer, which is also known as
// SSL v3.3. As of this writing, Mbed TLS still does not support
// version 1.3, and we would want to test it before enabling it here.
// We *require* TLS v1.2 or newer, which is also known as SSL
// v3.3.
cfg->min_ver = MBEDTLS_SSL_MINOR_VERSION_3;
#ifdef MBEDTLS_SSL_PROTO_TLS1_3
cfg->max_ver = MBEDTLS_SSL_MINOR_VERSION_4;
Expand Down Expand Up @@ -689,16 +688,6 @@ config_version(nng_tls_engine_config *cfg, nng_tls_version min_ver,
return (NNG_ENOTSUP);
}
switch (min_ver) {
#ifdef MBEDTLS_SSL_MINOR_VERSION_1
case NNG_TLS_1_0:
v1 = MBEDTLS_SSL_MINOR_VERSION_1;
break;
#endif
#ifdef MBEDTLS_SSL_MINOR_VERSION_2
case NNG_TLS_1_1:
v1 = MBEDTLS_SSL_MINOR_VERSION_2;
break;
#endif
#ifdef MBEDTLS_SSL_MINOR_VERSION_3
case NNG_TLS_1_2:
v1 = MBEDTLS_SSL_MINOR_VERSION_3;
Expand All @@ -716,16 +705,6 @@ config_version(nng_tls_engine_config *cfg, nng_tls_version min_ver,
}

switch (max_ver) {
#ifdef MBEDTLS_SSL_MINOR_VERSION_1
case NNG_TLS_1_0:
v2 = MBEDTLS_SSL_MINOR_VERSION_1;
break;
#endif
#ifdef MBEDTLS_SSL_MINOR_VERSION_2
case NNG_TLS_1_1:
v2 = MBEDTLS_SSL_MINOR_VERSION_2;
break;
#endif
#ifdef MBEDTLS_SSL_MINOR_VERSION_3
case NNG_TLS_1_2:
v2 = MBEDTLS_SSL_MINOR_VERSION_3;
Expand Down
6 changes: 0 additions & 6 deletions src/supplemental/tls/wolfssl/wolfssl.c
Original file line number Diff line number Diff line change
Expand Up @@ -602,12 +602,6 @@ wolf_config_version(nng_tls_engine_config *cfg, nng_tls_version min_ver,
return (NNG_ENOTSUP);
}
switch (min_ver) {
case NNG_TLS_1_0:
rv = wolfSSL_CTX_SetMinVersion(cfg->ctx, WOLFSSL_TLSV1);
break;
case NNG_TLS_1_1:
rv = wolfSSL_CTX_SetMinVersion(cfg->ctx, WOLFSSL_TLSV1_1);
break;
case NNG_TLS_1_2:
rv = wolfSSL_CTX_SetMinVersion(cfg->ctx, WOLFSSL_TLSV1_2);
break;
Expand Down

0 comments on commit f93efef

Please sign in to comment.