From 7da12a670eafbbdc32c9613826cc03e447b4d21d Mon Sep 17 00:00:00 2001 From: Marten Seemann Date: Fri, 27 Oct 2023 12:35:07 +0700 Subject: [PATCH] handshake: set MinVersion on the Config returned by GetConfigForClient (#4134) --- internal/handshake/crypto_setup.go | 2 ++ internal/handshake/crypto_setup_test.go | 9 ++++++++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/internal/handshake/crypto_setup.go b/internal/handshake/crypto_setup.go index e6e2208ae60..861494c47a8 100644 --- a/internal/handshake/crypto_setup.go +++ b/internal/handshake/crypto_setup.go @@ -147,6 +147,8 @@ func addConnToClientHelloInfo(conf *tls.Config, localAddr, remoteAddr net.Addr) c, err := gcfc(info) if c != nil { c = c.Clone() + // This won't be necessary anymore once https://github.com/golang/go/issues/63722 is accepted. + c.MinVersion = tls.VersionTLS13 // We're returning a tls.Config here, so we need to apply this recursively. addConnToClientHelloInfo(c, localAddr, remoteAddr) } diff --git a/internal/handshake/crypto_setup_test.go b/internal/handshake/crypto_setup_test.go index 9fa6fb802af..52a5262792b 100644 --- a/internal/handshake/crypto_setup_test.go +++ b/internal/handshake/crypto_setup_test.go @@ -140,10 +140,12 @@ var _ = Describe("Crypto Setup TLS", func() { }, } addConnToClientHelloInfo(tlsConf, local, remote) - _, err := tlsConf.GetConfigForClient(&tls.ClientHelloInfo{}) + conf, err := tlsConf.GetConfigForClient(&tls.ClientHelloInfo{}) Expect(err).ToNot(HaveOccurred()) Expect(localAddr).To(Equal(local)) Expect(remoteAddr).To(Equal(remote)) + Expect(conf).ToNot(BeNil()) + Expect(conf.MinVersion).To(BeEquivalentTo(tls.VersionTLS13)) }) It("wraps GetConfigForClient, recursively", func() { @@ -158,18 +160,23 @@ var _ = Describe("Crypto Setup TLS", func() { } tlsConf.GetConfigForClient = func(info *tls.ClientHelloInfo) (*tls.Config, error) { innerConf = tlsConf.Clone() + // set the MaxVersion, so we can check that quic-go doesn't overwrite the user's config + innerConf.MaxVersion = tls.VersionTLS12 innerConf.GetCertificate = getCert return innerConf, nil } addConnToClientHelloInfo(tlsConf, local, remote) conf, err := tlsConf.GetConfigForClient(&tls.ClientHelloInfo{}) Expect(err).ToNot(HaveOccurred()) + Expect(conf).ToNot(BeNil()) + Expect(conf.MinVersion).To(BeEquivalentTo(tls.VersionTLS13)) _, err = conf.GetCertificate(&tls.ClientHelloInfo{}) Expect(err).ToNot(HaveOccurred()) Expect(localAddr).To(Equal(local)) Expect(remoteAddr).To(Equal(remote)) // make sure that the tls.Config returned by GetConfigForClient isn't modified Expect(reflect.ValueOf(innerConf.GetCertificate).Pointer() == reflect.ValueOf(getCert).Pointer()).To(BeTrue()) + Expect(innerConf.MaxVersion).To(BeEquivalentTo(tls.VersionTLS12)) }) })