crypto/tls: missing check for versions offered in ClientHello when using QUIC

[marten-seemann]

What version of Go are you using (go version)?

$ go version
go version go1.21.0 darwin/arm64

Does this issue reproduce with the latest release?

Yes

What did you do?

RFC 9001 Section 4.2 requires the server to check the client's offered TLS versions:

Clients MUST NOT offer TLS versions older than 1.3.

What did you expect to see?

I expected crypto/tls to perform this required check.

What did you see instead?

It didn't.

[gopherbot]

Change https://go.dev/cl/537576 mentions this issue: crypto/tls: check client's supported versions when using QUIC

[dr2chase]

@neild this seems related to #63722

[marten-seemann]

As I pointed out in https://go-review.googlesource.com/c/go/+/537576/comments/da21b228_b5c4580f, the current check for Config.MinVersion in QUICConn.Start is not sufficient to prevent a version older than TLS 1.3 from being negotiated if GetConfigForClient returns a Config that doesn't set the TLS 1.3 as the MinVersion.