[GitHub] [trafficserver] brbzull0 commented on a diff in pull request #9667: Add new settings to specify TLS versions to use

["brbzull0 (via GitHub)" <gi...@apache.org>]

brbzull0 commented on code in PR #9667:
URL: https://github.com/apache/trafficserver/pull/9667#discussion_r1182318785


##########
doc/admin-guide/files/records.yaml.en.rst:
##########
@@ -3583,11 +3583,45 @@ SSL Termination
 
    This configuration works with OpenSSL v1.0.2 and above.
 
+.. ts:cv:: CONFIG proxy.config.ssl.server.version.min INT -1
+
+   Specifies the minimum TLS version that will be offered to clients during the TLS negotiation.
+
+   ======== ===================================================================
+   Value    Version
+   ======== ===================================================================
+   ``0``    TLS 1.0
+   ``1``    TLS 1.1
+   ``2``    TLS 1.2
+   ``3``    TLS 1.3
+   ======== ===================================================================
+
+.. ts:cv:: CONFIG proxy.config.ssl.server.version.max INT -1
+
+   Specifies the maximum TLS version that will be offered to clients during the TLS negotiation.
+
+   ======== ===================================================================
+   Value    Version
+   ======== ===================================================================
+   ``0``    TLS 1.0
+   ``1``    TLS 1.1
+   ``2``    TLS 1.2
+   ``3``    TLS 1.3
+   ======== ===================================================================
+
 .. ts:cv:: CONFIG proxy.config.ssl.TLSv1 INT 0
+   :deprecated:
+
+   This setting is depreated in favor of :ts:cv:`proxy.config.ssl.server.version.min` and

Review Comment:
   type: deprecated
   there are more probably from the copy/paste



##########
iocore/net/SSLConfig.cc:
##########
@@ -280,47 +280,85 @@ SSLConfigParams::initialize()
 
   int option = 0;
 
-  REC_ReadConfigInteger(option, "proxy.config.ssl.TLSv1");
-  if (!option) {
-    ssl_ctx_options |= SSL_OP_NO_TLSv1;
-  }
+  REC_ReadConfigInteger(client_tls_ver_min, "proxy.config.ssl.client.version.min");
+  REC_ReadConfigInteger(client_tls_ver_max, "proxy.config.ssl.client.version.max");
+  if (client_tls_ver_min < 0 || client_tls_ver_max < 0) {
+    REC_ReadConfigInteger(option, "proxy.config.ssl.client.TLSv1");
+    if (!option) {
+      ssl_client_ctx_options |= SSL_OP_NO_TLSv1;
+    } else {
+      // This is disabled by default. It it's used if it's enabled.

Review Comment:
   typo: `It it's`



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org