brbzull0 commented on code in PR #9667:
URL: https://github.com/apache/trafficserver/pull/9667#discussion_r1182318785
##########
doc/admin-guide/files/records.yaml.en.rst:
##########
@@ -3583,11 +3583,45 @@ SSL Termination
This configuration works with OpenSSL v1.0.2 and above.
+.. ts:cv:: CONFIG proxy.config.ssl.server.version.min INT -1
+
+ Specifies the minimum TLS version that will be offered to clients during
the TLS negotiation.
+
+ ======== ===================================================================
+ Value Version
+ ======== ===================================================================
+ ``0`` TLS 1.0
+ ``1`` TLS 1.1
+ ``2`` TLS 1.2
+ ``3`` TLS 1.3
+ ======== ===================================================================
+
+.. ts:cv:: CONFIG proxy.config.ssl.server.version.max INT -1
+
+ Specifies the maximum TLS version that will be offered to clients during
the TLS negotiation.
+
+ ======== ===================================================================
+ Value Version
+ ======== ===================================================================
+ ``0`` TLS 1.0
+ ``1`` TLS 1.1
+ ``2`` TLS 1.2
+ ``3`` TLS 1.3
+ ======== ===================================================================
+
.. ts:cv:: CONFIG proxy.config.ssl.TLSv1 INT 0
+ :deprecated:
+
+ This setting is depreated in favor of
:ts:cv:`proxy.config.ssl.server.version.min` and
Review Comment:
type: deprecated
there are more probably from the copy/paste
##########
iocore/net/SSLConfig.cc:
##########
@@ -280,47 +280,85 @@ SSLConfigParams::initialize()
int option = 0;
- REC_ReadConfigInteger(option, "proxy.config.ssl.TLSv1");
- if (!option) {
- ssl_ctx_options |= SSL_OP_NO_TLSv1;
- }
+ REC_ReadConfigInteger(client_tls_ver_min,
"proxy.config.ssl.client.version.min");
+ REC_ReadConfigInteger(client_tls_ver_max,
"proxy.config.ssl.client.version.max");
+ if (client_tls_ver_min < 0 || client_tls_ver_max < 0) {
+ REC_ReadConfigInteger(option, "proxy.config.ssl.client.TLSv1");
+ if (!option) {
+ ssl_client_ctx_options |= SSL_OP_NO_TLSv1;
+ } else {
+ // This is disabled by default. It it's used if it's enabled.
Review Comment:
typo: `It it's`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
